CVE-2021-23399

This affects all versions of package wincred. If attacker-controlled user input is given to the getCredential function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.

• CWE-78

• https://github.com/rolangom/wincred/blob/3fd39186ee32add9c12046cdccf2765d19565335/index.ts%23L20Broken Link
• https://snyk.io/vuln/SNYK-JS-WINCRED-1078538Exploit, Third Party Advisory
• https://github.com/rolangom/wincred/blob/3fd39186ee32add9c12046cdccf2765d19565335/index.ts%23L20Broken Link
• https://snyk.io/vuln/SNYK-JS-WINCRED-1078538Exploit, Third Party Advisory

Published

Jun 28, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23393This affects the package Flask-Unchained before 0.9.0. When …5.4
• CVE-2021-23394The package studio-42/elfinder before 2.1.58 are vulnerable …9.8
• CVE-2021-23395This affects all versions of package nedb. The library could…5.3
• CVE-2021-23396All versions of package lutils are vulnerable to Prototype P…9.8
• CVE-2021-23397All versions of package @ianwalter/merge are vulnerable to P…9.8
• CVE-2021-23398All versions of package react-bootstrap-table are vulnerable…6.1
• CVE-2021-2340Vulnerability in the MySQL Server product of Oracle MySQL (c…2.7
• CVE-2021-23400The package nodemailer before 6.6.1 are vulnerable to HTTP H…8.8
• CVE-2021-23401This affects all versions of package Flask-User. When using …6.1
• CVE-2021-23402All versions of package record-like-deep-assign are vulnerab…9.8
• CVE-2021-23403All versions of package ts-nodash are vulnerable to Prototyp…9.8
• CVE-2021-23404This affects all versions of package sqlite-web. The SQL das…8.8