critical9.8
CVE-2023-40582
Command Injection Vulnerability in find-exec
Impact
Older versions of the package are vulnerable to Command Injection as an attacker controlled parameter. As a result, attackers may run malicious commands. For example: ``` const find = require("find-exec"); find("mplayer; touch hacked") ``` This creates a file named "hacked" on the filesystem. You should never allow users to control commands to find, since this package attempts to run every command provided. Thanks to @miguelafmonteiro for reporting.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | find-exec | < 1.0.3 | 1.0.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Find-Exec Project | Find-Exec | before 1.0.3 |