CVE-2021-34082

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

OS Command Injection vulnerability in allenhwkim proctree through 0.1.1 and commit 0ac10ae575459457838f14e21d5996f2fa5c7593 for Node.js, allows attackers to execute arbitrary commands via the fix function.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://advisory.checkmarx.net/advisory/CX-2021-4783Exploit, Third Party Advisory
https://github.com/allenhwkim/proctree/blob/master/index.js#L46Exploit, Third Party Advisory
https://advisory.checkmarx.net/advisory/CX-2021-4783Exploit, Third Party Advisory
https://github.com/allenhwkim/proctree/blob/master/index.js#L46Exploit, Third Party Advisory

Timeline

Published: Jun 2, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-340838.1Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format. When using CVE-2021-340849.8OS command injection vulnerability in Turistforeningen node-s3-uploader through 2.0.3 for Node.js allows attackers to execute arbitrary comm CVE-2021-340859.8Read access violation in the III_dequantize_sample function in mpglibDBL/layer3.c in mp3gain through 1.5.2-r2 allows remote attackers to cau CVE-2021-340868.8In Ultimaker S3 3D printer, Ultimaker S5 3D printer, Ultimaker 3 3D printer S-line through 6.3 and Ultimaker 3 through 5.2.16, the local web CVE-2021-340877.1In Ultimaker S3 3D printer, Ultimaker S5 3D printer, Ultimaker 3 3D printer S-line through 6.3 and Ultimaker 3 through 5.2.16, the local web CVE-2021-34095.7The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access CVE-2021-34107.8A flaw was found in libcaca v0.99.beta19. A buffer overflow issue in caca_resize function in libcaca/caca/canvas.c may lead to local executi CVE-2021-34116.7A flaw was found in the Linux kernel in versions prior to 5.10. A violation of memory access was found while detecting a padding of int3 in CVE-2021-341107.8WinWaste.NET version 1.0.6183.16475 has incorrect permissions, allowing a local unprivileged user to replace the executable with a malicious CVE-2021-341119.8Thecus 4800Eco was discovered to contain a command injection vulnerability via the username parameter in /adm/setmain.php.CVE-2021-341177.5SQL Injection vulnerability in SEO Panel 4.9.0 in api/user.api.php in function getUserName in the username parameter, allows attackers to ga CVE-2021-341197.8A flaw was discovered in htmodoc 1.9.12 in function parse_paragraph in ps-pdf.cxx ,this flaw possibly allows possible code execution and a d