CVE-2022-41945: Improper Neutralization of Special Elements used in a Command ('Command Injection')

November 21, 2022 (updated November 7, 2023)

super-xray is a vulnerability scanner (xray) GUI launcher. In version 0.1-beta, the URL is not filtered and directly spliced ??into the command, resulting in a possible RCE vulnerability. Users should upgrade to super-xray 0.2-beta.

References

github.com/4ra1n/super-xray/releases/tag/0.2-beta
github.com/4ra1n/super-xray/security/advisories/GHSA-732j-763p-cvqg
nvd.nist.gov/vuln/detail/CVE-2022-41945

Detect and mitigate CVE-2022-41945 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →