CVE-2023-49210 | BDVDB-2026-217684 Detail

Description#

The openssl (aka node-openssl) NPM package through 2.0.0 was characterized as "a nonsense wrapper with no real purpose" by its author, and accepts an opts argument that contains a verb field (used for command execution). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://gist.github.com/mcoimbra/b05a55a5760172dccaa0a827647ad63e
https://github.com/ossf/malicious-packages/tree/main/malicious/npm
https://www.npmjs.com/package/openssl

Exploit#

No public exploit known

History#

Version 12023-11-23Record published in the CVE List.
Version 22024-08-02Most recent update recorded in the CVE List.