CVE-2020-5282

HIGH

nick_chan_bot < 1.0.0-beta - OS Command Injection via npm Command

Title source: llm
STIX 2.1

Description

In Nick Chan Bot before version 1.0.0-beta there is a vulnerability in the `npm` command which is part of this software package. This allows arbitrary shell execution,which can compromise the bot This is patched in version 1.0.0-beta

References (2)

Core 2

Scores

CVSS v3 7.2
EPSS 0.0114
EPSS Percentile 62.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Details

CWE
CWE-78
Status published
Products (1)
nick_chan_bot_project/nick_chan_bot 1.0.0 beta_pre_11 (4 CPE variants)
Published Mar 25, 2020
Tracked Since Feb 18, 2026