CVE-2021-23352 (published 2021-03-09T19:15Z)

This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which when the .image(), .svg() or .dot() functions are called, is executed by the childprocess.exec function.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/pahen/madge
commit_details: repo_url: https://github.com/pahen/madge
author: Patrik Henningsson
author_date: 2021-03-05 15:42:51+01:00
msg: Fix potential command injection vulnerability
repository: repo_url: https://github.com/pahen/madge
repo_name: pahen/madge
description: Create graphs from your CommonJS, AMD or ES6 module dependencies
repo_language: JavaScript
owner: pahen
file_changes: filename: graph.js
change_type: ModificationType.MODIFY
diff: @@ -4,7 +4,7 @@ const path = require('path');
 const {promisify} = require('util');
 const graphviz = require('graphviz');
 
-const exec = promisify(require('child_process').exec);
+const exec = promisify(require('child_process').execFile);
 const writeFile = promisify(require('fs').writeFile);
 
 /**
@@ -22,19 +22,14 @@ function setNodeColor(node, color) {
  * @param  {Object} config
  * @return {Promise}
  */
-function checkGraphvizInstalled(config) {
-	if (config.graphVizPath) {
-		const cmd = path.join(config.graphVizPath, 'gvpr -V');
-		return exec(cmd)
-			.catch(() => {
-				throw new Error('Could not execute ' + cmd);
-			});
-	}
+async function checkGraphvizInstalled(config) {
+	const cmd = config.graphVizPath ? path.join(config.graphVizPath, 'gvpr') : 'gvpr';
 
-	return exec('gvpr -V')
-		.catch((error) => {
-			throw new Error('Graphviz could not be found. Ensure that "gvpr" is in your $PATH.\n' + error);
-		});
+	try {
+		await exec(cmd, ['-V']);
+	} catch (err) {
+		throw new Error(`Graphviz could not be found. Ensure that "gvpr" is in your $PATH. ${err}`);
+	}
 }
 
 /**

programming_language: JavaScript
filename: api.js
change_type: ModificationType.MODIFY
diff: @@ -313,7 +313,7 @@ describe('API', () => {
 			madge(__dirname + '/cjs/a.js', {graphVizPath: '/invalid/path'})
 				.then((res) => res.image('image.png'))
 				.catch((err) => {
-					err.message.should.match(/Could not execute .*gvpr \-V/);
+					err.message.should.eql('Graphviz could not be found. Ensure that "gvpr" is in your $PATH. Error: spawn /invalid/path/gvpr ENOENT');
 					done();
 				});
 		});

programming_language: JavaScript