GHSA-vmqq-7qvx-68qx
promise-probe OS command injection vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | promise-probe | < 0.1.10 | 0.1.10 |
Details
As written in the advisory (Markdown source, shown as plain text).
promise-probe before 0.10.0 allows remote attackers to perform a command injection attack. The `file`, `outputFile` and `options` functions can be controlled by users without any sanitization.
References
External links from the advisory. They lead to third-party sites.