Homepage
About Snyk

domokeeper@0.0.2 vulnerabilities

domokeeper server: a pluggable domotic control server for Raspberry Pi 2/3

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the domokeeper package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • C
Arbitrary Code Execution

domokeeper is a pluggable domotic control server for Raspberry Pi 2/3.

Affected versions of this package are vulnerable to Arbitrary Code Execution. /plugin/ route passes an unsanitized GET request to a require() call. It then returns the output of require() in the response.

How to fix Arbitrary Code Execution?

There is no fixed version for domokeeper.

>=0.0.0
  • M
Arbitrary Code Execution

domokeeper is a pluggable domotic control server for Raspberry Pi 2/3.

Affected versions of this package are vulnerable to Arbitrary Code Execution. The path to required module is passed in an HTTP request without any sanitisation, thus making it possible to load code that was not intended to run on the server. In addition, the fact that output of the module is passed to server response directly may cause information leakage. For example it is possible to read package.json file or any other json file.

How to fix Arbitrary Code Execution?

There is no fixed version for domokeeper.

*
Go back to all versions of this package