| Package | Affected versions | Patched versions |
|---|---|---|
| find-exec | < 1.0.3 | 1.0.3 |
| find-exec | < 1.0.3 | 1.0.3 |
Older versions of the package are vulnerable to Command Injection as an attacker controlled parameter. As a result, attackers may run malicious commands.
For example:
const find = require("find-exec");
find("mplayer; touch hacked")
This creates a file named "hacked" on the filesystem.
You should never allow users to control commands to find, since this package attempts to run every command provided.
Thanks to @miguelafmonteiro for reporting.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free