Command Injection in @ronomon/opened

published 2021-05-24 5 y ago modified 2026-06-17 4 mo ago also GHSA-fg5w-w99f-rj6w , EUVD-2021-1316

cvss: 9.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 4.5%; EPSS 4.5% chance of exploitation in 30 days, percentile 91%
public exploits: 0; none known

The @ronomon/opened library before 1.5.2 is vulnerable to a command injection vulnerability which would allow a remote attacker to execute commands on the system if the library was used with untrusted input.

Patch / fix

fixed in 2 links 1

npm @ronomon/opened 1.5.2
ronomon opened 1.5.2

github.com/ronomon/opened@7effe01 commit

Exploit prediction

4.51% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

advisory.checkmarx.net https://advisory.checkmarx.net/advisory/CX-2021-4775 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C
GitHub	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	@ronomon/opened	<1.5.2	1.5.2

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command
CWE-77 Improper Neutralization of Special Elements used in a Command

References

github.com /ronomon/opened/commit/7effe011d4fea8fac7f78c00615e0a6e69af68ec
web, patch, third-party-advisory
advisory.checkmarx.net /advisory/CX-2021-4775
web, exploit, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2021-29300
advisory
github.com /ronomon/opened
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary