GHSA-j9f8-8h89-j69x
Remote Code Execution in node-os-utils
Versions of node-os-utils prior to 1.1.0 are vulnerable to Remote Code Execution. Due to insufficient input validation an attacker could run arbitrary commands on the server thus rendering the package vulnerable to Remote Code Execution.
Recommendation
Upgrade to version 1.1.0 or later.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
What each source reports
GitHub Advisories Score used
Remote Code Execution in node-os-utils
Versions of node-os-utils prior to 1.1.0 are vulnerable to Remote Code Execution. Due to insufficient input validation an attacker could run arbitrary commands on the server thus rendering the package vulnerable to Remote Code Execution.
Recommendation
Upgrade to version 1.1.0 or later.
- Record
GHSA-j9f8-8h89-j69x- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
Remote Code Execution in node-os-utils
Versions of node-os-utils prior to 1.1.0 are vulnerable to Remote Code Execution. Due to insufficient input validation an attacker could run arbitrary commands on the server thus rendering the package vulnerable to Remote Code Execution.
Recommendation
Upgrade to version 1.1.0 or later.
- Record
GHSA-j9f8-8h89-j69x- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-94
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
node-os-utilsnpm | before 1.1.0 | 1.1.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-j9f8-8h89-j69x is a high vulnerability (CVSS 7.3) in node-os-utils, published June 11, 2019. No source lists public exploit code. Fixed in node-os-utils 1.1.0.