OS Command Injection in s3-uploader

CRITICO 9.8CVE-2021-34084 · GHSA-gwp3-f7mr-qpfv · Published 02/06/2022 · updated 17/06/2026

In breve

CVE-2021-34084 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda s3-uploader (s3-uploader project), s3-uploader.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 3.1%, superiore al 87.7% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
s3-uploader s3-uploader_project	`≤ 2.0.3`	No fix yet
s3-uploader npm	`≤ 2.0.3`	No fix yet

Description

OS command injection vulnerability in Turistforeningen node-s3-uploader through 2.0.3 for Node.js allows attackers to execute arbitrary commands via the metadata() function.

NVD description

OS command injection vulnerability in Turistforeningen node-s3-uploader through 2.0.3 for Node.js allows attackers to execute arbitrary commands via the metadata() function.

References

nvd.nist.gov/vuln/detail/CVE-2021-34084 · ADVISORY
advisory.checkmarx.net/advisory/CX-2021-4776 · WEB
Turistforeningen/node-s3-uploader · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free