CVE-2022-25171

9.8 criticalEPSS 2.5%

Critical (9.8) in p4 project p4. EPSS 2.5% chance of exploitation in the next 30 days. Fixed in p4 0.0.7.

The package p4 before 0.0.7 are vulnerable to Command Injection via the run() function due to improper input sanitization

Severity

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.5% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2022-12-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-jfm8-hwhg-r6gg	npm	p4	<0.0.7	0.0.7