CVE-2022-25926

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Versions of the package window-control before 1.4.5 are vulnerable to Command Injection via the sendKeys function, due to improper input sanitization.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78 CWE-94

Affected software

Vendor	Product	Versions
n/a	window-control	< 1.4.5

References

https://github.com/bruno-robert/window-control/commit/075c854534a749d887655a906759f5a7eee95173Patch, Third Party Advisory
https://github.com/bruno-robert/window-control/releases/tag/v1.4.5Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-WINDOWCONTROL-3186345Third Party Advisory
https://github.com/bruno-robert/window-control/commit/075c854534a749d887655a906759f5a7eee95173Patch, Third Party Advisory
https://github.com/bruno-robert/window-control/releases/tag/v1.4.5Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-WINDOWCONTROL-3186345Third Party Advisory

Timeline

Published: Jan 4, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-259277.5Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial CVE-2022-259295.4The package smoothie from 1.31.0 and before 1.36.1 are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization in s CVE-2022-25937.2The Better Search Replace WordPress plugin before 1.4.1 does not properly sanitise and escape table data before inserting it into a SQL quer CVE-2022-259317.5All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being emplo CVE-2022-259329.8The firmware of InHand Networks InRouter302 V3.5.45 introduces fixes for TALOS-2022-1472 and TALOS-2022-1474. The fixes are incomplete. An a CVE-2022-259367.5Versions of the package servst before 2.0.3 are vulnerable to Directory Traversal due to improper sanitization of the filePath variable.CVE-2022-259376.5Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root di CVE-2022-25948.8The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated CVE-2022-259407.5All versions of package lite-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control ch CVE-2022-259427.8An out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead t CVE-2022-259437.8The installer of WPS Office for Windows versions prior to v11.2.0.10258 fails to configure properly the ACL for the directory where the serv CVE-2022-259466.5On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configur