CVE-2020-7603

{"containers": {"cna": {"affected": [{"product": "closure-compiler-stream", "vendor": "n/a", "versions": [{"status": "affected", "version": "All versions including 0.1.15"}]}], "descriptions": [{"lang": "en", "value": "closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument \"options\" of the exports function in \"index.js\" can be controlled by users without any sanitization."}], "problemTypes": [{"descriptions": [{"description": "Command Injection", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-03-15T21:48:52.000Z", "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "shortName": "snyk"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://snyk.io/vuln/SNYK-JS-CLOSURECOMPILERSTREAM-560123"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "report@snyk.io", "ID": "CVE-2020-7603", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "closure-compiler-stream", "version": {"version_data": [{"version_value": "All versions including 0.1.15"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument \"options\" of the exports function in \"index.js\" can be controlled by users without any sanitization."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Command Injection"}]}]}, "references": {"reference_data": [{"name": "https://snyk.io/vuln/SNYK-JS-CLOSURECOMPILERSTREAM-560123", "refsource": "MISC", "url": "https://snyk.io/vuln/SNYK-JS-CLOSURECOMPILERSTREAM-560123"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T09:33:20.013Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://snyk.io/vuln/SNYK-JS-CLOSURECOMPILERSTREAM-560123"}]}]}, "cveMetadata": {"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "assignerShortName": "snyk", "cveId": "CVE-2020-7603", "datePublished": "2020-03-15T21:48:52.000Z", "dateReserved": "2020-01-21T00:00:00.000Z", "dateUpdated": "2024-08-04T09:33:20.013Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "closure-compiler-stream", "vendor": "n/a", "versions": [{"status": "affected", "version": "All versions including 0.1.15"}]}], "source": "report@snyk.io"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:closure-compiler-stream_project:closure-compiler-stream:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "3D96AD92-7C35-43C1-90E5-5EE0E71E194F", "versionEndIncluding": "0.1.15", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument \"options\" of the exports function in \"index.js\" can be controlled by users without any sanitization."}, {"lang": "es", "value": "closure-compiler-stream versiones hasta 0.1.15, permite una ejecuci\u00f3n de comandos arbitraria. El argumento \"options\" de la funci\u00f3n de exportaci\u00f3n en el archivo \"index.js\" puede ser controlado por los usuarios sin ning\u00fan saneamiento."}], "id": "CVE-2020-7603", "lastModified": "2026-06-17T03:25:06.310", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-03-15T22:15:14.660", "references": [{"source": "report@snyk.io", "tags": ["Exploit", "Third Party Advisory"], "url": "https://snyk.io/vuln/SNYK-JS-CLOSURECOMPILERSTREAM-560123"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://snyk.io/vuln/SNYK-JS-CLOSURECOMPILERSTREAM-560123"}], "sourceIdentifier": "report@snyk.io", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}