Created
May 6, 2026 19:59
-
-
Save 6en6ar/607368f1fc8fe429f03c6e0d9486ba72 to your computer and use it in GitHub Desktop.
Public disclosure of security issue in NPM package @jswork/next-npm-version through version 1.0.1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Product: https://www.npmjs.com/package/@jswork/next-npm-version | |
| Version: v1.0.1 | |
| Vulnerability type: Command injection inside @jswork/next-npm-version through version 1.0.1 | |
| CVE ID: CVE-2025-63706 | |
| Description: | |
| NPM package next-npm-version through function nx.npmVersion defined on line 19. inside index.js does not properly sanitize inName variable before it is passed to execSync which executes a command using npm show. | |
| An attacker is able to inject code when calling npmVersion function to check the version of the npm package. This is possible because the code is not sanitizing inName variable before it is passed to child_process execSync. | |
| This code uses npm show to cli command to execute the code. | |
| Payload used: | |
| > import '@jswork/next-npm-version'; | |
| > | |
| > console.log(nx.npmVersion('node-ts-ocr && id #')); | |
| > // '2.6.0' | |
| > | |
| > This executes the 'id' command. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment