CodeceptJS's incomprehensive sanitation can lead to Command Injection

CRITICAL 9.8CVE-2025-57285 · GHSA-34w8-mcwr-vg29 · Published 08/09/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
codeceptjs codecept	`= 3.7.3`	No fix yet
codeceptjs npm	`≥ 3.5.0, < 3.7.5`	`3.7.5`

Description

CodeceptJS versions 3.5.0 through 3.7.5-beta.18 contain a command injection vulnerability in the emptyFolder function (lib/utils.js). The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands.

NVD description

codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function (lib/utils.js). The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands.

References

nvd.nist.gov/vuln/detail/CVE-2025-57285 · ADVISORY
codeceptjs/CodeceptJS#3604 · WEB
codeceptjs/CodeceptJS#5190 · WEB
gist.github.com/Dremig/1ba111f9b1f7cffe1fcb4838b64e55b9 · WEB
codeceptjs/CodeceptJS · PACKAGE
npmjs.com · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free