CVE-2021-23377

This affects all versions of package onion-oled-js. If attacker-controlled user input is given to the scroll function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.

• CWE-78

• https://github.com/naddeoa/onion-oled-js/blob/8a523645d2cc29130f98de661b742893773d760d/src/oled-exp.js%23L91Broken Link
• https://snyk.io/vuln/SNYK-JS-ONIONOLEDJS-1078808Exploit, Third Party Advisory
• https://github.com/naddeoa/onion-oled-js/blob/8a523645d2cc29130f98de661b742893773d760d/src/oled-exp.js%23L91Broken Link
• https://snyk.io/vuln/SNYK-JS-ONIONOLEDJS-1078808Exploit, Third Party Advisory

Published

Apr 18, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23371This affects the package chrono-node before 2.2.4. It hangs …7.5
• CVE-2021-23372All versions of package mongo-express are vulnerable to Deni…7.5
• CVE-2021-23373All versions of package set-deep-prop are vulnerable to Prot…9.8
• CVE-2021-23374This affects all versions of package ps-visitor. If attacker…9.8
• CVE-2021-23375This affects all versions of package psnode. If attacker-con…9.8
• CVE-2021-23376This affects all versions of package ffmpegdotjs. If attacke…9.8
• CVE-2021-23378This affects all versions of package picotts. If attacker-co…9.8
• CVE-2021-23379This affects all versions of package portkiller. If (attacke…9.8
• CVE-2021-2338Vulnerability in the Siebel Apps - Marketing product of Orac…6.1
• CVE-2021-23380This affects all versions of package roar-pidusage. If attac…7.3
• CVE-2021-23381This affects all versions of package killing. If attacker-co…9.8
• CVE-2021-23382The package postcss before 8.2.13 are vulnerable to Regular …7.5