CVE-2022-25906: Snyk Vulnerability Database | Snyk

**Command Injection Affecting is-http2 package, versions *******

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

• Snyk ID SNYK-JS-ISHTTP2-3153878
• published 31 Jan 2023
• disclosed 5 Dec 2022
• credit JHU System Security Lab

How to fix?

There is no fixed version for is-http2.

Overview

Affected versions of this package are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes being employed to the isH2 function.

PoC

var root = require("is-http2")
root("./",{openssl:"touch JHU"})