{"id":"GHSA-vvj3-85vf-fgmw","summary":"global-modules-path Command Injection vulnerability","details":"Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the getPath function.","aliases":["CVE-2022-21191"],"modified":"2025-04-04T19:33:44Z","published":"2023-01-13T06:30:22Z","database_specific":{"cwe_ids":["CWE-77","CWE-78"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2023-01-13T21:33:18Z","nvd_published_at":"2023-01-13T05:15:00Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21191"},{"type":"WEB","url":"https://github.com/rosen-vladimirov/global-modules-path/commit/edbdaff077ea0cf295b1469923c06bbccad3c180"},{"type":"WEB","url":"https://github.com/lorenzomigliorero/npm-node-utils/blob/b55dd81c597db657c9751332bb2242403fd3e26b/index.js%23L186"},{"type":"PACKAGE","url":"https://github.com/rosen-vladimirov/global-modules-path"},{"type":"WEB","url":"https://github.com/rosen-vladimirov/global-modules-path/releases/tag/v3.0.0"},{"type":"WEB","url":"https://security.snyk.io/vuln/SNYK-JS-GLOBALMODULESPATH-3167973"}],"affected":[{"package":{"name":"global-modules-path","ecosystem":"npm","purl":"pkg:npm/global-modules-path"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-vvj3-85vf-fgmw/GHSA-vvj3-85vf-fgmw.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}