CVE-2023-40582
Critical
Description
find-exec is a utility to discover available shell commands. Versions prior to 1.0.3 did not properly escape user input and are vulnerable to Command Injection via an attacker controlled parameter. As a result, attackers may run malicious shell commands in the context of the running process. This issue has been addressed in version 1.0.3. users are advised to upgrade. Users unable to upgrade should ensure that all input passed to find-exec comes from a trusted source.
SeverityCritical
CVSS9.8
Exploit probability—
ProductFind-exec
PublishedAug 30, 2023
First seenAug 30, 2023
Weakness typeCWE-78OS command injection
How to fix
Update
- find-exec_project find-exec1.0.3 or later
- find-exec1.0.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| find-exec_project find-exec | v < 1.0.3 | 1.0.3 |
| find-execnpm | v < 1.0.3 | 1.0.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.