CVE-2017-16100

dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve() method then command injection is possible.

Score

CVSS 3.0 9.8 Critical

Status

Modified - support@hackerone.com

Published

2018-06-07

Last modified

2024-09-17

Weaknesses

CWE-77, CWE-94

Affected products

• Dns-sync (Dns-sync Project)
• Dns-sync Node Module (Hackerone)

References

• https://github.com/skoranga/node-dns-sync/issues/5
• https://nodesecurity.io/advisories/523