CVE-2019-10778

devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The variable `commonName` controlled by user input is used as part of the `exec` function without any sanitization.

Score

CVSS 3.1 9.8 Critical

Status

Modified - report@snyk.io

Published

2020-01-08

Last modified

2024-08-04

Weaknesses

CWE-78

Affected products

• Devcert-sanscache (Devcert-sanscache Project)

References

• https://snyk.io/vuln/SNYK-JS-DEVCERTSANSCACHE-540926