CVE-2023-40582

{"id": "CVE-2023-40582", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-40582", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2024-10-01T18:13:32.639859Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "shime", "product": "find-exec", "versions": [{"status": "affected", "version": "< 1.0.3"}]}]}], "published": "2023-08-30T18:15:09.783", "references": [{"url": "https://github.com/shime/find-exec/commit/74fb108097c229b03d6dba4cce81e36aa364b51c", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/shime/find-exec/security/advisories/GHSA-95rp-6gqp-6622", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/shime/find-exec/commit/74fb108097c229b03d6dba4cce81e36aa364b51c", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/shime/find-exec/security/advisories/GHSA-95rp-6gqp-6622", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "find-exec is a utility to discover available shell commands. Versions prior to 1.0.3 did not properly escape user input and are vulnerable to Command Injection via an attacker controlled parameter. As a result, attackers may run malicious shell commands in the context of the running process. This issue has been addressed in version 1.0.3. users are advised to upgrade. Users unable to upgrade should ensure that all input passed to find-exec comes from a trusted source."}, {"lang": "es", "value": "find-exec es una utilidad para descubrir comandos de shell disponibles. Las versiones anteriores a la 1.0.3 no escapaban correctamente la entrada del usuario y son vulnerables a la inyecci\u00f3n de comandos a trav\u00e9s de un par\u00e1metro controlado por un atacante. Como resultado, los atacantes pueden ejecutar comandos de shell maliciosos en el contexto del proceso en ejecuci\u00f3n. Este problema ha sido abordado en la versi\u00f3n 1.0.3. Se aconseja a los usuarios actualizar. Los usuarios que no puedan actualizar deben asegurarse de que toda la entrada pasada a find-exec provenga de una fuente confiable."}], "lastModified": "2026-06-17T06:18:34.207", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:find-exec_project:find-exec:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "9D212061-F058-4CB9-A96E-23856D97B658", "versionEndExcluding": "1.0.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}