CVE-2023-26107: Code Injection
Published Mar 6, 2023
·Updated
All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametrization while concatenating the current directory as part of the command string.
Affected Software
1 affected component
eBay Sketchsvg
Event History
Mar 6, 2023
CVE Published
via MITRE·05:00 AM
Data Sourced
via MITRE·05:00 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2023-26107?
CVE-2023-26107 is considered a high severity vulnerability due to its potential for arbitrary code execution.
2
How do I fix CVE-2023-26107?
To fix CVE-2023-26107, sanitize and parameterize all inputs passed to shell.exec to prevent command injection.
3
Which software is affected by CVE-2023-26107?
CVE-2023-26107 affects all versions of the eBay Sketchsvg package.
4
What type of vulnerability is CVE-2023-26107?
CVE-2023-26107 is classified as an Arbitrary Code Injection vulnerability.
5
What actions should be taken if CVE-2023-26107 is exploited?
If CVE-2023-26107 is exploited, immediate remediation by updating the package and reviewing the code for secure coding practices is recommended.