node-modbus-serial
node-modbus-serial copied to clipboard
Can cause application to execute malicious command
Method EIO_Close at line 583 of /node_modules/@serialport/bindings/src/serialport_win.cpp loads a library whose name or location is influenced by input from the client in the "kernel32.dll" element. This element’s value then flows through the code without being properly validated, in EIO_Close at line 583 of se-node-red-modbus/node_modules/@serialport/bindings/src/serialport_win.cpp. Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands.