GHSA-8mrf-64fw-2x75

Command injection in fs-path

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-8298

Packages

Ecosystem	Package	Affected	Fixed in
npm	fs-path	< 0.0.25	0.0.25

Details

As written in the advisory (Markdown source, shown as plain text).

fs-path node module before 0.0.25 is vulnerable to command injection by way of user-supplied inputs via the `copy`, `copySync`, `remove`, and `removeSync` methods.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-8298 advisory
https://github.com/pillys/fs-path/pull/6 web
https://github.com/pillys/fs-path/commit/88ff5ee51046bb2c5d5e9c5afe6819b032092ce7 web
https://hackerone.com/reports/324491 web