Description
All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. Every exported method used by the package uses the exec function to parse user input.
References (1)
Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://snyk.io/vuln/SNYK-JS-LSOF-543632
Scores
CVSS v3
9.8
EPSS
0.0264
EPSS Percentile
83.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-78
Status
published
Products (2)
isof_project/isof
< 0.0.4
npm/lsof
0npm
Published
Jan 29, 2020
Tracked Since
Feb 18, 2026