Command Injection in install-package package for npm

Published: 2020-04-07 | Updated: 2020-07-23
Risk High
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2020-7629
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Vulnerable software
Web applications / Modules and components for CMS

Vendor Shogo Sensui

Security Bulletin

This security bulletin contains information about 1 vulnerabilities.

Updated: 23.07.2020

Changed bulletin status to patched.

1) Command Injection

EUVDB-ID: #VU26629

Risk: High

CVSSv3.1: 9.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C]

CVE-ID: CVE-2020-7629

CWE-ID: CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Exploit availability: No


The vulnerability allows a remote attacker to execute arbitrary commands on the system.

The vulnerability exists due to improper input validation in the "options" argument. A remote attacker can execute arbitrary commands on the target system.


Install update from vendor's website.

Vulnerable software versions

install-package: 0.1.0 - 0.4.0

CPE2.3 External links,

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.