GHSA-c6rx-gxqv-vr5jCriticalCVSS 9.8

nemo-appium vulnerable to OS Command Injection

Published
January 31, 2023
Last Modified
February 7, 2023

🔗 CVE IDs covered (1)

CVE-2022-21129 →

📋 Description

Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function.

Note: In order to exploit this vulnerability appium-running 0.1.3 has to be installed as one of nemo-appium dependencies.

🎯 Affected products1

  • npm/nemo-appium:< 0.0.9

🔗 References (5)