GHSA-cr6m-62pq-hmqh
OS Command injection in npm-lockfile
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | npm-lockfile | >= 2.0.3, < 2.0.5 | 2.0.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
npm-lockfile safely generates an npm lockfile and output it to the filename of your choice. npm-lockfile before 2.0.4 does not santize unsafe external input and invoke sensitive command execution API with the input, causing command injection vulnerability. A fix was released in version 2.0.5.
References
External links from the advisory. They lead to third-party sites.