Description
serial-number through 1.3.0 allows execution of arbritary commands. The "cmdPrefix" argument in serialNumber function is used by the "exec" function without any validation.
Remediation
References
https://github.com/es128/serial-number/blob/master/index.js#L106
https://snyk.io/vuln/SNYK-JS-SERIALNUMBER-559010
Related Vulnerabilities
CVE-2019-19771 Vulnerability in npm package sb58
CVE-2019-2391 Vulnerability in npm package bson
CVE-2021-25915 Vulnerability in npm package changeset
CVE-2022-29253 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore
CVE-2020-2238 Vulnerability in maven package org.jenkins-ci.plugins:git-parameter