{"id":"GHSA-28xh-wpgr-7fm8","aliases":[],"status":"published","title":"Command Injection in open","description":"Versions of `open` before 6.0.0 are vulnerable to command injection when unsanitized user input is passed in.\n\nThe package does come with the following warning in the readme:\n\n```\nThe same care should be taken when calling open as if you were calling child_process.exec directly. If it is an executable it will run in a new shell.\n```\n\n\n## Recommendation\n\n`open` is now the deprecated `opn` package. Upgrading to the latest version is likely have unwanted effects since it now has a very different API but will prevent this vulnerability.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2019-06-20T15:35:49Z","modified":"2023-01-09T05:01:44Z","fixes":[{"ecosystem":"npm","package":"open","fixed_in":["6.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"open","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0"}]}]},{"source":"osv","ecosystem":"npm","package":"open","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.0.0"}]}]}],"references":[{"url":"https://github.com/pwnall/node-open/issues/68","tags":["web"]},{"url":"https://github.com/pwnall/node-open/issues/69","tags":["web"]},{"url":"https://hackerone.com/reports/319473","tags":["web"]},{"url":"https://www.npmjs.com/advisories/663","tags":["web"]},{"url":"https://github.com/advisories/GHSA-28xh-wpgr-7fm8"}],"sources":{"ghsa":[{"id":"GHSA-28xh-wpgr-7fm8","title":"Command Injection in open","description":"Versions of `open` before 6.0.0 are vulnerable to command injection when unsanitized user input is passed in.\n\nThe package does come with the following warning in the readme:\n\n```\nThe same care should be taken when calling open as if you were calling child_process.exec directly. If it is an executable it will run in a new shell.\n```\n\n\n## Recommendation\n\n`open` is now the deprecated `opn` package. Upgrading to the latest version is likely have unwanted effects since it now has a very different API but will prevent this vulnerability.","status":"published","published":"2019-06-20T15:35:49Z","modified":"2023-01-09T05:01:44Z","cwes":["CWE-77"],"updated_at":"2026-11-02T14:36:02.073372Z"}],"osv":[{"id":"GHSA-28xh-wpgr-7fm8","title":"Command Injection in open","description":"Versions of `open` before 6.0.0 are vulnerable to command injection when unsanitized user input is passed in.\n\nThe package does come with the following warning in the readme:\n\n```\nThe same care should be taken when calling open as if you were calling child_process.exec directly. If it is an executable it will run in a new shell.\n```\n\n\n## Recommendation\n\n`open` is now the deprecated `opn` package. Upgrading to the latest version is likely have unwanted effects since it now has a very different API but will prevent this vulnerability.","status":"published","published":"2019-06-20T15:35:49Z","modified":"2020-08-31T18:31:51Z","cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:33.956911Z"}]}}