Description
The printDirect function in lib/printer.js in the node-printer module 0.0.1 and earlier for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in the lpr command.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | printer | < 0.0.2 | 0.0.2 | GHSA-5c8j-xr24-2665 |
References
- [oss-security] 20140514 Re: CVE request: various NodeJS module vulnerabilities mailing-list
- [oss-security] 20140513 CVE request: various NodeJS module vulnerabilities mailing-list
- https://nodesecurity.io/advisories/printer_potential_command_injection
- https://github.com/tojocky/node-printer/commit/e001e38738c17219a1d9dd8c31f7d82b9c0013c7