Most recent entries from all

EUVD-2026-234894

fkie_cve-2022-41642

OS command injection vulnerability in Nadesiko3 (PC Version) v3.3.61 and earlier allows a remote attacker to execute an arbitrary OS command when processing compression and decompression on the product.

GHSA-m8r5-7wf4-63mw — Nadesiko3 OS Command Injection vulnerability

Affected: npm: nadesiko3

OS command injection vulnerability in Nadesiko3 (PC Version) v3.3.68 and earlier allows a remote attacker to execute an arbitrary OS command when processing compression and decompression on the product.

Release notes for versions 3.3.62 and 3.3.69 both link to patches for this particular issue. The [JPCERT/CC](https://jvn.jp/en/jp/JVN56968681/index.html) advisory lists versions 3.3.68 and prior as vulnerable, and the most recent patch for this issue is tagged with version 3.3.69.

gsd-2022-41642

jvndb-2022-000082

Nadesiko3 provided by kujirahand contains multiple vulnerabilities listed below. <ul> <li>OS command injection vulnerability in processing compression and decompression (CWE-78) - CVE-2022-41642 </li> <li>Improper check or handling of exceptional conditions in nako3edit (CWE-703) - CVE-2022-41777 </li> <li>OS command injection vulnerability via "file" parameter in nako3edit (CWE-78) - CVE-2022-42496 </li> </ul> Satoki Tsuji reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.