critical10.0
CVE-2018-16462
Command Injection in apex-publish-static-files
Impact
Versions of `apex-publish-static-files` before 2.0.1 are vulnerable to command injection. This is exploitable if user input is passed into the `connectString` option in the `publish` method. ## Recommendation Update to version 2.0.1 or later.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | apex-publish-static-files | < 2.0.1 | 2.0.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apex-Publish-Static-Files Project | Apex-Publish-Static-Files | before 2.0.1 |