Command and Code Injection

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

1. A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed becaus…CVE-2022-43548NodeJS · CVSS 8.1 · 15% likely

   CWE-781 bounty report

2. Command injection vulnerability in programing languages on Microsoft Windows operating system.CVE-2024-3566Node.js · CVSS 9.8 · 6.8% likely

   CWE-78

3. Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code exec…CVE-2024-27980NodeJS · CVSS 8.1 · 1.4% likely

   CWE-77

4. Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly modu…CVE-2023-39333NodeJS · CVSS 5.3 · 1.1% likely

   CWE-94

5. A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising syst…CVE-2024-22020NodeJS · CVSS 6.5 · 1.1% likely

   CWE-941 bounty report

6. Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn / child_process.spawnSyn…CVE-2024-36138NodeJS · CVSS 8.1 · 1.1% likely

   CWE-771 bounty report

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.