CVE-2023-26107

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-26107
All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametrization while concatenating the current directory as part of the command string.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L115 Broken Link
https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L64 Broken Link
https://security.snyk.io/vuln/SNYK-JS-SKETCHSVG-3167969 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:ebay:sketchsvg:-:*:*:*:*:*:*:*
History

07 Nov 2023, 04:09

Type Values Removed Values Added
Summary All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametrization while concatenating the current directory as part of the command string. All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametrization while concatenating the current directory as part of the command string.

10 Mar 2023, 22:43

Type Values Removed Values Added
References (MISC) https://security.snyk.io/vuln/SNYK-JS-SKETCHSVG-3167969 - (MISC) https://security.snyk.io/vuln/SNYK-JS-SKETCHSVG-3167969 - Exploit, Third Party Advisory
References (MISC) https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L115 - (MISC) https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L115 - Broken Link
References (MISC) https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L64 - (MISC) https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L64 - Broken Link
CWE CWE-94
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Ebay sketchsvg
Ebay
CPE cpe:2.3:a:ebay:sketchsvg:-:*:*:*:*:*:*:*

06 Mar 2023, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-03-06 05:15

Updated : 2023-12-10 14:48

NVD link : CVE-2023-26107

Mitre link : CVE-2023-26107

CVE.ORG link : CVE-2023-26107

JSON object : View

Products Affected

ebay

  • sketchsvg
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')