CVE-2022-21810
Severity CVSS v4.0:
Pending analysis
Type:
CWE-78
OS Command Injections
Publication date:
26/01/2023
Last modified:
01/04/2025
Description
All versions of the package smartctl are vulnerable to Command Injection via the info method due to improper input sanitization.<br />
<br />
Impact
Base Score 3.x
7.40
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:smartctl_project:smartctl:*:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://github.com/baslr/node-smartctl/blob/f61266084d5b3e4baae9bd85f67ec4ec6a716736/index.js%23L18
- https://security.snyk.io/vuln/SNYK-JS-SMARTCTL-3175613
- https://github.com/baslr/node-smartctl/blob/f61266084d5b3e4baae9bd85f67ec4ec6a716736/index.js%23L18
- https://security.snyk.io/vuln/SNYK-JS-SMARTCTL-3175613



