CVE-2022-42496

CRITICAL

nadesiko3 < 3.3.74 - OS Command Injection in Nako3edit

Title source: llm
STIX 2.1

Description

OS command injection vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to obtain appkey of the product and execute an arbitrary OS command on the product.

References (3)

Core 3
Core References
Issue Tracking, Patch, Third Party Advisory
https://github.com/kujirahand/nadesiko3/issues/1325
Issue Tracking, Third Party Advisory
https://github.com/kujirahand/nadesiko3/issues/1347

Scores

CVSS v3 9.8
EPSS 0.0234
EPSS Percentile 85.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-78
Status published
Products (2)
kujirahand/nadesiko3 < 3.3.74
npm/nadesiko3 0 - 3.3.75npm
Published Dec 05, 2022
Tracked Since Feb 18, 2026