Versions 0.0.1 and earlier of printer are affected by a command injection vulnerability resulting from a failure to sanitize command arguments properly in the printDirect() function.

Recommendation

Update to version 0.0.2 or later.

References

• https://nvd.nist.gov/vuln/detail/CVE-2014-3741
• tojocky/node-printer@e001e38
• GHSA-5c8j-xr24-2665
• https://www.npmjs.com/advisories/27
• http://www.openwall.com/lists/oss-security/2014/05/13/1
• http://www.openwall.com/lists/oss-security/2014/05/15/2