GHSA-8j6j-4h2c-c65p
Arbitrary Code Execution in require-node
Versions of require-node prior to 1.3.4 for 1.x and 2.0.4 for 2.x are vulnerable to Arbitrary Code Execution. The package fails to sanitize requests to the require-node endpoint, allowing attackers to execute arbitrary code in the server through the injection of OS commands in the request body.
Recommendation
- If you are using 1.x, upgrade to version 1.3.4 or later.
- If you are using 2.x, upgrade to version 2.0.4 or later.
What each source reports
GitHub AdvisoriesNo score
Arbitrary Code Execution in require-node
Versions of require-node prior to 1.3.4 for 1.x and 2.0.4 for 2.x are vulnerable to Arbitrary Code Execution. The package fails to sanitize requests to the require-node endpoint, allowing attackers to execute arbitrary code in the server through the injection of OS commands in the request body.
Recommendation
- If you are using 1.x, upgrade to version 1.3.4 or later.
- If you are using 2.x, upgrade to version 2.0.4 or later.
- Record
GHSA-8j6j-4h2c-c65p- Weakness
- CWE-78
- Updated
- 2026-11-02
OSVNo score
Arbitrary Code Execution in require-node
Versions of require-node prior to 1.3.4 for 1.x and 2.0.4 for 2.x are vulnerable to Arbitrary Code Execution. The package fails to sanitize requests to the require-node endpoint, allowing attackers to execute arbitrary code in the server through the injection of OS commands in the request body.
Recommendation
- If you are using 1.x, upgrade to version 1.3.4 or later.
- If you are using 2.x, upgrade to version 2.0.4 or later.
- Record
GHSA-8j6j-4h2c-c65p- Weakness
- CWE-78
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
require-nodenpm | before 1.3.4 | 1.3.4 |
require-nodenpm | 2.0.0 up to 2.0.4 | 2.0.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-8j6j-4h2c-c65p is a vulnerability with no CVSS score yet in require-node, published September 3, 2020. No source lists public exploit code. Fixed in require-node 1.3.4.