Command injection in node-dns-sync

CRÍTICO 9.8CVE-2020-11079 · GHSA-wh69-wc6q-7888 · Published 28/05/2020 · updated 17/06/2026

Em resumo

CVE-2020-11079 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta node-dns-sync (node-dns-sync project), dns-sync.
Chance de exploração nos próximos 30 dias (EPSS): 2.7%, maior que 85.9% das vulnerabilidades.
Correção: atualize para 0.2.1 ou posterior.

Package	Affected versions	Patched versions
node-dns-sync node-dns-sync_project	`< 0.2.1`	`0.2.1`
dns-sync npm	`≥ 0.1.3, < 0.2.1`	`0.2.1`

Description

dns-sync through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.

NVD description

node-dns-sync (npm module dns-sync) through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This has been fixed in 0.2.1.

References

skoranga/node-dns-sync security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2020-11079 · ADVISORY
skoranga/node-dns-sync commit cb10a5a · WEB
skoranga/node-dns-sync · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free