Description
serial-number through 1.3.0 allows execution of arbritary commands. The "cmdPrefix" argument in serialNumber function is used by the "exec" function without any validation.
Remediation
References
https://snyk.io/vuln/SNYK-JS-SERIALNUMBER-559010
https://github.com/es128/serial-number/blob/master/index.js#L106
Related Vulnerabilities
CVE-2021-21266 Vulnerability in maven package org.openhab.addons.bundles:org.openhab.binding.insteon
CVE-2022-25900 Vulnerability in npm package git-clone
CVE-2021-42697 Vulnerability in maven package com.typesafe.akka:akka-http-core_2.13
CVE-2022-0624 Vulnerability in npm package parse-path
CVE-2020-14326 Vulnerability in maven package org.jboss.resteasy:resteasy-core