CVE-2020-7632: 
JavaScript vulnerability analysis and mitigation

node-mpv through 1.4.3 is vulnerable to Command Injection. The vulnerability allows execution of arbitrary commands via the options argument (MITRE CVE).

The vulnerability exists in the way node-mpv handles the options argument. The package allows execution of arbitrary commands without proper validation or sanitization of user input. The vulnerability has been assigned a CVSS v3.0 score of 7.5, indicating a high severity level (CISA Bulletin).

A successful exploitation of this vulnerability could allow attackers to execute arbitrary commands on the affected system with the privileges of the application running node-mpv. This could potentially lead to complete system compromise depending on the context in which the application is running (MITRE CVE).

The vulnerability can be exploited by passing malicious input through the options argument. The attack requires the ability to provide input to the application using node-mpv (CISA Bulletin).

Users should upgrade to a version newer than 1.4.3 if available. If upgrading is not possible, it is recommended to carefully validate and sanitize any input passed to the options argument (MITRE CVE).