CVE-2021-23399

CVE-2021-23399 is a critical command injection vulnerability affecting all versions of the 'wincred' package, specifically within the 'getCredential' function. An attacker can achieve arbitrary command execution by providing malicious input due to the lack of input sanitization when using 'child_process exec'. This vulnerability carries a CVSS score of 9.8 (Critical), indicating a network-exploitable flaw with low attack complexity and high impact on confidentiality, integrity, and availability. Despite its severity, there is currently no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.