{"id":"CVE-2022-25171","aliases":["EUVD-2022-7664","GHSA-jfm8-hwhg-r6gg"],"status":"published","title":"Command Injection","description":"The package p4 before 0.0.7 are vulnerable to Command Injection via the run() function due to improper input sanitization","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0247,"percentile":0.84645,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2022-12-20T05:15:11.26Z","modified":"2026-10-28T02:30:30Z","fixes":[{"ecosystem":"npm","package":"p4","fixed_in":["0.0.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"p4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.7"}]}]},{"source":"osv","ecosystem":"npm","package":"p4","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.7"}]}]}],"products":[{"vendor":"p4_project","product":"p4"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-JS-P4-3167330","tags":["x_transferred","Exploit","Patch","Third Party Advisory","web"]},{"url":"https://github.com/natelong/p4/blob/master/p4.js%23L12","tags":["x_transferred","Broken Link","Third Party Advisory","web"]},{"url":"https://github.com/natelong/p4/commit/ae42e251beabf67c00539ec0e1d7aa149ca445fb","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25171","tags":["advisory"]},{"url":"https://github.com/natelong/p4/blob/master/p4.js#23L12","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jfm8-hwhg-r6gg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25171.json","tags":["advisory"]},{"url":"https://github.com/natelong/p4","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-25171","title":"Command Injection","description":"The package p4 before 0.0.7 are vulnerable to Command Injection via the run() function due to improper input sanitization","status":"published","published":"2022-12-21T01:21:43.83Z","modified":"2025-04-16T14:42:51.719Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:28.707644Z"}],"euvd":[{"id":"EUVD-2022-7664","description":"The package p4 before 0.0.7 are vulnerable to Command Injection via the run() function due to improper input sanitization","status":"published","published":"2022-12-21T01:21:43Z","modified":"2025-04-16T14:42:51Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P","level":"high"}],"updated_at":"2026-11-02T20:52:25.343198Z"}],"ghsa":[{"id":"GHSA-jfm8-hwhg-r6gg","title":"p4 vulnerable to Command Injection due to improper input sanitization","description":"The package p4 before 0.0.7 is vulnerable to Command Injection via the run() function due to improper input sanitization","status":"published","published":"2022-12-20T06:30:36Z","modified":"2023-08-17T05:02:31Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:37:00.074932Z"}],"nvd":[{"id":"CVE-2022-25171","description":"The package p4 before 0.0.7 are vulnerable to Command Injection via the run() function due to improper input sanitization","status":"published","published":"2022-12-20T05:15:11.26Z","modified":"2026-06-17T04:33:08.74Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:07:34.031641Z"}],"osv":[{"id":"CVE-2022-25171","title":"Command Injection","description":"The package p4 before 0.0.7 are vulnerable to Command Injection via the run() function due to improper input sanitization","status":"published","published":"2022-12-20T05:15:11.26Z","modified":"2026-10-28T02:30:30.99969203Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P","level":"high"}],"updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"GHSA-jfm8-hwhg-r6gg","title":"p4 vulnerable to Command Injection due to improper input sanitization","description":"The package p4 before 0.0.7 is vulnerable to Command Injection via the run() function due to improper input sanitization","status":"published","published":"2022-12-20T06:30:36Z","modified":"2025-04-16T16:08:22Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:50.336262Z"}]}}