Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWdjOTQtNnc4OS1ocHFy

Command Injection in fs-path

All versions of fs-path are vulnerable to command injection is unsanitized user input is passed in.

Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.

Permalink: https://github.com/advisories/GHSA-gc94-6w89-hpqr
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWdjOTQtNnc4OS1ocHFy
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 5 years ago
Updated: almost 2 years ago

Identifiers: GHSA-gc94-6w89-hpqr
References:

• https://hackerone.com/reports/324491
• https://www.npmjs.com/advisories/661
• https://github.com/pillys/fs-path/pull/5
• https://github.com/advisories/GHSA-gc94-6w89-hpqr

Repository: https://github.com/pillys/fs-path
Blast Radius: 0.0

Affected Packages