{"id":"GHSA-8j6j-4h2c-c65p","aliases":[],"status":"published","title":"Arbitrary Code Execution in require-node","description":"Versions of `require-node` prior to 1.3.4 for 1.x and 2.0.4 for 2.x are vulnerable to Arbitrary Code Execution. The package fails to sanitize requests to the `require-node` endpoint, allowing attackers to execute arbitrary code in the server through the injection of OS commands in the request body.\n\n\n## Recommendation\n\n- If you are using 1.x, upgrade to version 1.3.4 or later.\n- If you are using 2.x, upgrade to version 2.0.4 or later.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2020-09-03T17:02:52Z","modified":"2023-01-12T05:02:03Z","fixes":[{"ecosystem":"npm","package":"require-node","fixed_in":["1.3.4","2.0.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"require-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"require-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.4"}]}]},{"source":"osv","ecosystem":"npm","package":"require-node","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.4"}]}]},{"source":"osv","ecosystem":"npm","package":"require-node","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.4"}]}]}],"references":[{"url":"https://www.npmjs.com/advisories/1015","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8j6j-4h2c-c65p"}],"sources":{"ghsa":[{"id":"GHSA-8j6j-4h2c-c65p","title":"Arbitrary Code Execution in require-node","description":"Versions of `require-node` prior to 1.3.4 for 1.x and 2.0.4 for 2.x are vulnerable to Arbitrary Code Execution. The package fails to sanitize requests to the `require-node` endpoint, allowing attackers to execute arbitrary code in the server through the injection of OS commands in the request body.\n\n\n## Recommendation\n\n- If you are using 1.x, upgrade to version 1.3.4 or later.\n- If you are using 2.x, upgrade to version 2.0.4 or later.","status":"published","published":"2020-09-03T17:02:52Z","modified":"2023-01-12T05:02:03Z","cwes":["CWE-78"],"updated_at":"2026-11-02T14:36:13.23016Z"}],"osv":[{"id":"GHSA-8j6j-4h2c-c65p","title":"Arbitrary Code Execution in require-node","description":"Versions of `require-node` prior to 1.3.4 for 1.x and 2.0.4 for 2.x are vulnerable to Arbitrary Code Execution. The package fails to sanitize requests to the `require-node` endpoint, allowing attackers to execute arbitrary code in the server through the injection of OS commands in the request body.\n\n\n## Recommendation\n\n- If you are using 1.x, upgrade to version 1.3.4 or later.\n- If you are using 2.x, upgrade to version 2.0.4 or later.","status":"published","published":"2020-09-03T17:02:52Z","modified":"2020-08-31T18:44:11Z","cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:42.437513Z"}]}}