GHSA-97m3-w2cp-4xx6

    Dashboard / Vulnerabilities / GHSA-97m3-w2cp-4xx6

    GHSA-97m3-w2cp-4xx6

    Published: 16 Mar 2022Last Modified: 16 Mar 2026

    Summary: Embedded Malicious Code in node-ipc

    Details: The package node-ipc versions 10.1.1 and 10.1.2 are vulnerable to embedded malicious code that was introduced by the maintainer. The malicious code was intended to overwrite arbitrary files dependent upon the geo-location of the user IP address. The maintainer removed the malicious code in version 10.1.3.

    References: https://nvd.nist.gov/vuln/detail/CVE-2022-23812, https://github.com/RIAEvangelist/node-ipc/issues/233, https://github.com/RIAEvangelist/node-ipc/issues/236, https://github.com/RIAEvangelist/node-ipc/commit/847047cf7f81ab08352038b2204f0e7633449580, https://github.com/RIAEvangelist/node-ipc, https://github.com/RIAEvangelist/node-ipc/blob/847047cf7f81ab08352038b2204f0e7633449580/dao/ssl-geospec.js, https://security.netapp.com/advisory/ntap-20220407-0005, https://snyk.io/vuln/SNYK-JS-NODEIPC-2426370

    Affected packages

    Package

    Name: node-ipc

    Purl: pkg:npm/node-ipc

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 10.1.1
    Fixed -10.1.3

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-97m3-w2cp-4xx6 | CVE-DB