Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function.
Date: 2023-01
Affected: paypal/nemo-appium
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2022-21129
CWE: CWE-77
CWE-78
CVSS: 7.4 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function. **Note:** In order to exploit this vulnerability appium-running 0.1.3 has to be installed as one of nemo-appium dependencies.


Mitigations:

Architectural layers (MAESTRO):