Description
im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument. The cmd argument used within index.js, can be controlled by user without any sanitization.
Remediation
References
https://github.com/Turistforeningen/node-im-resize/commit/de624dacf6a50e39fe3472af1414d44937ce1f03
https://snyk.io/vuln/SNYK-JS-IMRESIZE-544183
Related Vulnerabilities
CVE-2021-45046 Vulnerability in maven package org.apache.logging.log4j:log4j-core
CVE-2021-34083 Vulnerability in npm package google-it
CVE-2022-36090 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore
CVE-2022-25904 Vulnerability in npm package safe-eval
CVE-2022-36892 Vulnerability in maven package org.jenkins-ci.plugins:rhnpush-plugin