CVE-2020-7627: 
JavaScript vulnerability analysis and mitigation

The vulnerability CVE-2020-7627 affects node-key-sender through version 1.0.11, a Node.js module designed to send keyboard events to the operating system. The vulnerability was discovered and disclosed on April 2, 2020, by the JHU System Security Lab (NVD, Snyk).

The vulnerability is classified as a Command Injection flaw where the 'arrParams' argument in the 'execute()' function can be controlled by users without any sanitization. This allows for arbitrary command execution through the package. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (medium) by Snyk and 9.8 (critical) by NVD, indicating significant severity (Snyk).

The vulnerability allows attackers to execute arbitrary commands via the 'arrParams' argument in the 'execute()' function. This could lead to complete system compromise, as successful exploitation could result in total loss of confidentiality and unauthorized command execution on the affected system (Snyk).

Currently, there is no fixed version available for node-key-sender. Users are advised to consider alternative packages or implement additional security controls to prevent command injection attacks (Snyk).