CVE-2023-26107

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-26107
All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametrization while concatenating the current directory as part of the command string.

7.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L115 Broken Link
https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L115 Broken Link
https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L64 Broken Link
https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L64 Broken Link
https://security.snyk.io/vuln/SNYK-JS-SKETCHSVG-3167969 Exploit Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-SKETCHSVG-3167969 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:ebay:sketchsvg:-:*:*:*:*:*:*:*
History

05 Mar 2025, 20:15

Type Values Removed Values Added
References (MISC) https://security.snyk.io/vuln/SNYK-JS-SKETCHSVG-3167969 - Exploit, Third Party Advisory () https://security.snyk.io/vuln/SNYK-JS-SKETCHSVG-3167969 - Exploit, Third Party Advisory
References (MISC) https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L115 - Broken Link () https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L115 - Broken Link
References (MISC) https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L64 - Broken Link () https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L64 - Broken Link

07 Nov 2023, 04:09

Type Values Removed Values Added
Summary All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametrization while concatenating the current directory as part of the command string. All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametrization while concatenating the current directory as part of the command string.
Information

Published : 2023-03-06 05:15

Updated : 2025-03-05 20:15

NVD link : CVE-2023-26107

Mitre link : CVE-2023-26107

JSON object : View

Products Affected

ebay

  • sketchsvg
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')