← All advisories

High severity7.4NVD Advisory· Published Jan 26, 2023· Updated Jun 17, 2026

CVE-2022-25350

CVE-2022-25350

Description

All versions of the package puppet-facter are vulnerable to Command Injection via the getFact function due to improper input sanitization.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
puppet-facternpm	<= 0.0.2	—

Affected products

3

Helecloud/Puppet Facter
cpe:2.3:a:helecloud:puppet-facter:*:*:*:*:*:node.js:*:*
puppet-facter/puppet-facterdescription
ghsa-coords
pkg:npm/puppet-facter
Range: <= 0.0.2

Patches

Vulnerability mechanics

References

5

security.snyk.io/vuln/SNYK-JS-PUPPETFACTER-3175616nvdExploitThird Party AdvisoryWEB
github.com/advisories/GHSA-g5qr-xgg7-8q2wghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2022-25350ghsaADVISORY
github.com/olindata/node-puppet-facter/blob/f34bcc754325d71bb3b1b534804e53d6170f15f5/index.jsghsaWEB
github.com/olindata/node-puppet-facter/blob/f34bcc754325d71bb3b1b534804e53d6170f15f5/index.js%23L10nvdBroken Link

News mentions

0

No linked articles in our index yet.