node-modbus-serial icon indicating copy to clipboard operation
node-modbus-serial copied to clipboard

Can cause application to execute malicious command

Open ponguruswamy opened this issue 3 years ago • 0 comments

Method EIO_Close at line 583 of /node_modules/@serialport/bindings/src/serialport_win.cpp loads a library whose name or location is influenced by input from the client in the "kernel32.dll" element. This element’s value then flows through the code without being properly validated, in EIO_Close at line 583 of se-node-red-modbus/node_modules/@serialport/bindings/src/serialport_win.cpp. Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands.

ponguruswamy avatar Dec 16 '21 11:12 ponguruswamy