GHSA-95rp-6gqp-6622
Command Injection Vulnerability in find-exec
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
Older versions of the package are vulnerable to Command Injection as an attacker controlled parameter. As a result, attackers may run malicious commands.
For example:
```
const find = require("find-exec");
find("mplayer; touch hacked")
```
This creates a file named "hacked" on the filesystem.
You should never allow users to control commands to find, since this package attempts to run every command provided.
Thanks to @miguelafmonteiro for reporting.
References
External links from the advisory. They lead to third-party sites.