GHSA-4x6x-782q-jfc4
Command Injection in node-wifi
Versions of node-wifi prior to 2.0.12 are vulnerable to Command Injection. The package fails to sanitize user input, allowing attackers to inject commands through the ssid variable and possibly achieving Remote Code Execution on the system.
Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
What each source reports
GitHub AdvisoriesNo score
Command Injection in node-wifi
Versions of node-wifi prior to 2.0.12 are vulnerable to Command Injection. The package fails to sanitize user input, allowing attackers to inject commands through the ssid variable and possibly achieving Remote Code Execution on the system.
Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
- Record
GHSA-4x6x-782q-jfc4- Weakness
- CWE-77
- Updated
- 2026-11-02
OSVNo score
Command Injection in node-wifi
Versions of node-wifi prior to 2.0.12 are vulnerable to Command Injection. The package fails to sanitize user input, allowing attackers to inject commands through the ssid variable and possibly achieving Remote Code Execution on the system.
Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
- Record
GHSA-4x6x-782q-jfc4- Weakness
- CWE-77
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
node-wifinpm | before 2.0.12 | 2.0.12 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-4x6x-782q-jfc4 is a vulnerability with no CVSS score yet in node-wifi, published September 3, 2020. No source lists public exploit code. Fixed in node-wifi 2.0.12.