Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2022-25926

Versions of the package window-control before 1.4.5 are vulnerable to Command Injection via the sendKeys function, due to improper input sanitization.

VectorLOCAL

PublishedJan 04, 2023, 18:15

Published Byreport@snyk.io

Base Score

Score7.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

window-control(npm)01.4.5N/A

References

https://github.com/bruno-robert/window-control/commit/075c854534a749d887655a906759f5a7eee95173
https://github.com/bruno-robert/window-control/releases/tag/v1.4.5
https://security.snyk.io/vuln/SNYK-JS-WINDOWCONTROL-3186345

Weakness Type

NVD-CWE-Other

CVSS Metrics

Base Score

7.8

Vector String

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

LOCAL