CVE-2022-21129

Name: CVE-2022-21129
Creator: NVD / NIST
Published: 2023-01-31T05:15:11.06+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.8/10EPSS 2.77%

Last modified Jun 17, 2026

CVE-2022-21129 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function. **Note:** In order to exploit this vulnerability appium-running 0.1.3 has to be installed as one of nemo-appium dependencies. . EPSS estimates a 2.77% chance of exploitation in the next 30 days.

Description

Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function. **Note:** In order to exploit this vulnerability appium-running 0.1.3 has to be installed as one of nemo-appium dependencies.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

2.77%

84.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Paypal	Nemo-Appium	< 0.0.9

References

https://github.com/paypal/nemo-appium/blob/master/index.js%23L27Broken Link
https://github.com/paypal/nemo-appium/commit/aa271d36dd5c81baae3c43aa2616c84f0ee4195fPatch, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-NEMOAPPIUM-3183747Exploit, Third Party Advisory
https://github.com/paypal/nemo-appium/blob/master/index.js%23L27Broken Link
https://github.com/paypal/nemo-appium/commit/aa271d36dd5c81baae3c43aa2616c84f0ee4195fPatch, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-NEMOAPPIUM-3183747Exploit, Third Party Advisory

Timeline

Published: Jan 31, 2023
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2022-21129?

How severe is CVE-2022-21129?

CVE-2022-21129 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 2.77% probability of exploitation in the next 30 days.

How do I fix CVE-2022-21129?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-21129?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST