CVE-2020-7606

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within 'index.js' of the package, the function 'exec(serviceName, cmd, fnStdout, fnStderr, fnExit)' uses the variable 'serviceName' which can be controlled by users without any sanitization.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	docker-compose-remote-api	All versions including 0.1.4

References

https://snyk.io/vuln/SNYK-JS-DOCKERCOMPOSEREMOTEAPI-560125Exploit, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-DOCKERCOMPOSEREMOTEAPI-560125Exploit, Third Party Advisory

Timeline

Published: Mar 15, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-76079.8gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument 'options' of the exports function in 'index.js' can be co CVE-2020-76085.3yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.CVE-2020-76099.8node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function "fromJSON()" can be con CVE-2020-76109.8All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an objec CVE-2020-76119.8All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from 1.3.0 before 1.3.2 are vulnerable to HTTP Request Hea CVE-2020-76138.1clamscan through 1.2.0 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the `_is_clamav_binary` fu CVE-2020-76149.8npm-programmatic through 0.0.12 is vulnerable to Command Injection.The packages and option properties are concatenated together without any CVE-2020-76157.8fsa through 0.5.1 is vulnerable to Command Injection. The first argument of 'execGitCommand()', located within 'lib/rep.js#63' can be contro CVE-2020-76165.3express-mock-middleware through 0.0.6 is vulnerable to Prototype Pollution. Exported functions by the package can be tricked into adding or CVE-2020-76179.8ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of Object.pro CVE-2020-76185.3sds through 3.2.0 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of the 'Object.proto CVE-2020-76199.8get-git-data through 1.3.1 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the arguments provided