CVE-2023-40582

    Dashboard / Vulnerabilities / CVE-2023-40582

    CVE-2023-40582

    Published: 30 Aug 2023Last Modified: 12 Aug 2026

    Summary: Command Injection Vulnerability in find-exec

    Details: find-exec is a utility to discover available shell commands. Versions prior to 1.0.3 did not properly escape user input and are vulnerable to Command Injection via an attacker controlled parameter. As a result, attackers may run malicious shell commands in the context of the running process. This issue has been addressed in version 1.0.3. users are advised to upgrade. Users unable to upgrade should ensure that all input passed to find-exec comes from a trusted source.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40582.json, https://github.com/shime/find-exec/security/advisories/GHSA-95rp-6gqp-6622, https://nvd.nist.gov/vuln/detail/CVE-2023-40582, https://github.com/shime/find-exec/commit/74fb108097c229b03d6dba4cce81e36aa364b51c

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -421238ab3f6b4a55745aea43abc62c8b1db6d66c

    Affected versions

    v1.0.2
    v1.0.1
    v1.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-40582 | CVE-DB