CVE-2023-26127

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

All versions of the package n158 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports' function. **Note:** To execute the code snippet and potentially exploit the vulnerability, the attacker needs to have the ability to run Node.js code within the target environment. This typically requires some level of access to the system or application hosting the Node.js environment.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78CWE-77

Affected software

No affected versions have been published.

Timeline

Published
May 27, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-261287.8All versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and sanCVE-2023-261297.8All versions of the package bwm-ng are vulnerable to Command Injection due to improper input sanitization in the 'check' function in the bwmCVE-2023-261308.8Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the contCVE-2023-261316.1All versions of the package github.com/xyproto/algernon/engine; all versions of the package github.com/xyproto/algernon/themes are vulnerablCVE-2023-261327.5Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and theCVE-2023-261339.8All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js.CVE-2023-261349.8Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfoCVE-2023-261359.8All versions of the package flatnest are vulnerable to Prototype Pollution via the nest() function in the flatnest/nest.js file.CVE-2023-261369.8Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookiCVE-2023-261376.1All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build headCVE-2023-261384.3All versions of the package drogonframework/drogon are vulnerable to CRLF Injection when untrusted user input is used to set request headersCVE-2023-261397.5Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() func
CVE-2023-26127: High severity, CVSS 7.8 | Vulnix