Command Injection

Vulnerability

The spritesheet-js package is vulnerable to command injection due to its dependency on the platform-command package [1]. The injection point is located at line 32 in lib/generator.js, which is triggered via the main entry point of the package [2][3].

Exploitability

An attacker can exploit this vulnerability by providing crafted input to the spritesheet-js command-line tool, for example via the scale option. This can be done without authentication, as the tool is typically run locally or in automated pipelines [3]. A proof-of-concept demonstrates that passing a value containing command separators (e.g., &) leads to arbitrary command execution [3].

Impact

Successful exploitation allows an attacker to execute arbitrary commands on the host system with the privileges of the user running spritesheet-js [3]. This can lead to data loss, privilege escalation, or further compromise.

Mitigation

As of the latest advisory, there is no fixed version of spritesheet-js [3]. The only mitigation is to avoid using the package or to carefully sanitize inputs if absolutely necessary. The vulnerability has a CVSS base score of 9.8 (Critical) [1].