dns-sync command injection vulnerability (GHSA-q5pq-pgrv-fh89)
Published: 2017-10-24T18:33:36Z
Aliases: CVE-2014-9682
Severity: CRITICAL · CWE: CWE-77

The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function.

Affected packages:
package: ecosystem: npm
name: dns-sync
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.1.1