{"id":"GHSA-jfm8-hwhg-r6gg","summary":"p4 vulnerable to Command Injection due to improper input sanitization","details":"The package p4 before 0.0.7 is vulnerable to Command Injection via the run() function due to improper input sanitization","aliases":["CVE-2022-25171"],"modified":"2025-04-16T16:08:22Z","published":"2022-12-20T06:30:36Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2022-12-20T17:38:21Z","nvd_published_at":"2022-12-20T05:15:00Z","cwe_ids":["CWE-78"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25171"},{"type":"WEB","url":"https://github.com/natelong/p4/commit/ae42e251beabf67c00539ec0e1d7aa149ca445fb"},{"type":"PACKAGE","url":"https://github.com/natelong/p4"},{"type":"WEB","url":"https://github.com/natelong/p4/blob/master/p4.js#23L12"},{"type":"WEB","url":"https://security.snyk.io/vuln/SNYK-JS-P4-3167330"}],"affected":[{"package":{"name":"p4","ecosystem":"npm","purl":"pkg:npm/p4"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.7"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-jfm8-hwhg-r6gg/GHSA-jfm8-hwhg-r6gg.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}