CRITICAL9.8
GHSA-7249-8x22-4rg4
nadesiko3 vulnerable to OS Command Injection
Quick fix
GHSA-7249-8x22-4rg4 — nadesiko3: upgrade to the fixed version with the command below.
npm install nadesiko3@3.3.75Details
OS command injection vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to obtain appkey of the product and execute an arbitrary OS command on the product.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-42496[ADVISORY]
- https://github.com/kujirahand/nadesiko3/issues/1325[WEB]
- https://github.com/kujirahand/nadesiko3/issues/1347[WEB]
- https://github.com/kujirahand/nadesiko3[PACKAGE]
- https://github.com/kujirahand/nadesiko3/releases/tag/3.3.75[WEB]
- https://jvn.jp/en/jp/JVN56968681/index.html[WEB]