GHSA-vm5j-vqr6-v7v8
OS Command Injection in pixl-class
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | pixl-class | < 1.0.3 | 1.0.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
pixl-class prior to 1.0.3 allows execution of arbitrary commands. The members argument of the create function can be controlled by users without any sanitization.
References
External links from the advisory. They lead to third-party sites.