CVE-2022-25906

EUVD-2023-0595
All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes being employed to the isH2 function.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.4 HIGH
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
snykCNA
7.4 HIGH
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 57%
Affected Products (NVD)
VendorProductVersion
is-http2_projectis-http2
-
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/stefanjudis/is-http2/blob/master/index.js%23L23
https://security.snyk.io/vuln/SNYK-JS-ISHTTP2-3153878
https://github.com/stefanjudis/is-http2/blob/master/index.js%23L23
https://security.snyk.io/vuln/SNYK-JS-ISHTTP2-3153878