CVE-2021-23399

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

This affects all versions of package wincred. If attacker-controlled user input is given to the getCredential function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	wincred	< unspecified

References

https://github.com/rolangom/wincred/blob/3fd39186ee32add9c12046cdccf2765d19565335/index.ts%23L20Broken Link
https://snyk.io/vuln/SNYK-JS-WINCRED-1078538Exploit, Third Party Advisory
https://github.com/rolangom/wincred/blob/3fd39186ee32add9c12046cdccf2765d19565335/index.ts%23L20Broken Link
https://snyk.io/vuln/SNYK-JS-WINCRED-1078538Exploit, Third Party Advisory

Timeline

Published: Jun 28, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-23402.7Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Memcached). Supported versions that are affected are 8.0.25 an CVE-2021-234008.8The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage CVE-2021-234016.1This affects all versions of package Flask-User. When using the make_safe_url function, it is possible to bypass URL validation and redirect CVE-2021-234029.8All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality.CVE-2021-234039.8All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge() function due to lack of validation input.CVE-2021-234048.8This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the CVE-2021-234058.8This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method CVE-2021-234069.8This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:*CVE-2021-234077.5This affects the package elFinder.Net.Core from 0 and before 1.2.4. The user-controlled file name is not properly sanitized before it is use CVE-2021-234084.3This affects the package com.graphhopper:graphhopper-web-bundle before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked in CVE-2021-234097.5The package github.com/pires/go-proxyproto before 0.6.0 are vulnerable to Denial of Service (DoS) via creating connections without the proxy CVE-2021-23413.1Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that a