CVE-2020-28440: 
JavaScript vulnerability analysis and mitigation

All versions of package corenlp-js-interface are vulnerable to Command Injection via the main function. This vulnerability was discovered and disclosed on December 11, 2020, and was assigned CVE-2020-28440. The vulnerability affects all versions of the package and has been given a CVSS v3.1 base score of 9.8 (Critical) (Snyk).

The vulnerability is a Command Injection flaw (CWE-78) that exists in the main function of the corenlp-js-interface package. The package is vulnerable to command injection attacks when processing user input, allowing attackers to execute arbitrary commands. The CVSS score of 9.8 reflects the critical severity, with the vulnerability being network-accessible, requiring low attack complexity, no privileges, and no user interaction to exploit (Snyk).

If exploited, this vulnerability can lead to a complete compromise of the system's confidentiality, integrity, and availability. An attacker can execute arbitrary commands on the affected system, potentially leading to full system compromise. The CVSS metrics indicate high impact ratings for confidentiality, integrity, and availability (Snyk).

The vulnerability has a proof-of-concept exploit available. A simple proof of concept demonstrates the vulnerability can be triggered using the following code: var a = require("corenlp-js-interface"); a("') touch JHU # '","","",""); The exploit probability is rated at 0.37% (73rd percentile) according to the EPSS model (Snyk).

There is no fixed version available for corenlp-js-interface, as the package is deprecated. Users should consider migrating to alternative packages that provide similar functionality with proper security implementations (Snyk).