Command Injection

CVE-2020-7688 is a command injection vulnerability in the mversion npm package, a cross-packaging manager version handler. The flaw exists because the tagName parameter is passed directly to the exec function without sanitization, allowing arbitrary shell commands to be injected [1][2].

An attacker can exploit this by providing a malicious tagName value when calling the mversion.update() method. The proof of concept demonstrates appending a semicolon followed by a command (e.g., ; touch hbkhan) to the tagName, which gets executed in the shell [2][3]. No authentication is required if the attacker can control the input to the vulnerable function.

Successful exploitation leads to remote code execution (RCE) on the system running the vulnerable version of mversion. This could allow an attacker to execute arbitrary commands, potentially compromising the host environment [3].

The vulnerability affects mversion versions prior to 2.0.1. The fix was implemented in commit b7a8b32 by escaping the tagName with escapeQuotes() before passing it to exec [4]. Users should upgrade to version 2.0.1 or later. No workarounds are mentioned.