CRITICAL9.8

GHSA-gp2j-mg4w-2rh5

chrome-launcher subject to OS Command Injection

Quick fix

GHSA-gp2j-mg4w-2rh5 — chrome-launcher: upgrade to the fixed version with the command below.

npm install chrome-launcher@0.13.2

Details

chrome-launcher prior to 0.13.2 is subject to OS Command Injection via the `$HOME` environment variable in Linux operating systems. This issue is patched in version 0.13.2.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/chrome-launcher

Introduced in: 0Fixed in: 0.13.2

Fixnpm install chrome-launcher@0.13.2

References

https://nvd.nist.gov/vuln/detail/CVE-2020-7645[ADVISORY]
https://github.com/GoogleChrome/chrome-launcher/pull/197[WEB]
https://github.com/GoogleChrome/chrome-launcher[PACKAGE]
http://snyk.io/vuln/SNYK-JS-CHROMELAUNCHER-537575[WEB]