Skip to content
Heist/ feed
Back to feed
Critical

Security advisory

Type: advisorySources: OSVCVE: CVE-2021-23352

This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which when the .image(), .svg() or .dot() functions are called, is executed by the childprocess.exec function.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2021-23352
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 11:14 UTC · Revision 1

Source evidence

CVE-2021-23352

core-osv · Original source

Published 9 Mar 2021, 19:15 UTC

This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which when the .image(), .svg() or .dot() functions are called, is executed by the childprocess.exec function.

osv:CVE-2021-23352
Complete source record
{
  "id": "5e6546fdf25b02e8a364d5a7c9b3aa47ce34d2bf8bf5808c470481d8f63959da",
  "url": "https://osv.dev/vulnerability/CVE-2021-23352",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2021-23352",
    "summary": "This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which when the .image(), .svg() or .dot() functions are called, is executed by the childprocess.exec function.",
    "evidence": "osv:CVE-2021-23352",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2021-23352",
      "aliases": [
        "CVE-2021-23352",
        "GHSA-753c-phhg-cj29",
        "SNYK-JS-MADGE-1082875"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/pahen/madge",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "abae6d0dfe0c96218545bfe7fcffbb60322af3b4"
                },
                {
                  "fixed": "da5cbc9ab30372d687fa7c324b22af7ffa5c6332"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:madge_project:madge:*:*:*:*:*:node.js:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "4.0.1"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "da5cbc9ab30372d687fa7c324b22af7ffa5c6332"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v4.0.0",
            "v3.12.0",
            "v3.11.0",
            "v3.10.0",
            "v3.9.2",
            "v3.9.1",
            "v3.9.0",
            "v3.8.0",
            "v3.7.0",
            "v3.6.0",
            "v3.5.1",
            "v3.5.0",
            "v3.4.4",
            "v3.4.3",
            "v3.4.2",
            "v3.4.1",
            "v3.4.0",
            "v3.3.0",
            "v3.2.0",
            "v3.1.1",
            "v3.1.0",
            "v3.0.1",
            "v3.0.0",
            "v2.2.0",
            "v2.1.0",
            "v2.0.0",
            "v1.6.0",
            "v1.5.0",
            "v1.4.6",
            "v1.4.5",
            "v1.4.4",
            "v1.4.3",
            "v1.4.2",
            "v1.4.1",
            "v1.4.0",
            "v1.3.2",
            "v1.3.1",
            "v1.3.0",
            "v1.2.0",
            "v1.1.0",
            "0.6.0",
            "0.5.5",
            "0.5.4",
            "0.5.3",
            "0.5.2",
            "0.5.1",
            "0.5.0",
            "0.4.1",
            "0.4.0",
            "0.3.5",
            "0.3.3",
            "0.3.2",
            "0.3.1",
            "0.3.0",
            "0.2.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-23352.json"
          }
        }
      ],
      "modified": "2026-10-20T10:53:37.544790332Z",
      "provider": "osv",
      "references": [
        "https://github.com/pahen/madge/blob/master/lib/graph.js%23L27",
        "https://github.com/pahen/madge/commit/da5cbc9ab30372d687fa7c324b22af7ffa5c6332",
        "https://snyk.io/vuln/SNYK-JS-MADGE-1082875"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2021-23352",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 384443,
  "published_at": "2021-03-09T19:15:12.86+00:00"
}