GHSA-m647-5wf9-3jp3
OS Command Injection in closure-compiler-stream
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | closure-compiler-stream | <= 0.1.15 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument `options` of the exports function in `index.js` can be controlled by users without any sanitization.
References
External links from the advisory. They lead to third-party sites.