GHSA-9jm3-5835-537m
Command Injection in apex-publish-static-files
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | apex-publish-static-files | < 2.0.1 | 2.0.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
Versions of `apex-publish-static-files` before 2.0.1 are vulnerable to command injection. This is exploitable if user input is passed into the `connectString` option in the `publish` method.
## Recommendation
Update to version 2.0.1 or later.
References
External links from the advisory. They lead to third-party sites.