| Package | Affected versions | Patched versions |
|---|---|---|
| codeception/codeception | ≥ 4.0.0, < 4.1.22< 3.1.3 | 4.1.223.1.3 |
| codeception | ≥ 4.0.0, < 4.1.22< 3.1.3 | 4.1.223.1.3 |
This affects the package codeception/codeception from 4.0.0 before 4.1.22 and before 3.1.3. The RunProcess class can be leveraged as a gadget to run arbitrary commands on a system that is deserializing user input without validation.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free