Description

jscover through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary command via the source argument.

Remediation

References

https://snyk.io/vuln/SNYK-JS-JSCOVER-564250

https://github.com/node-modules/jscover/blob/master/lib/jscover.js#L59%2C

Related Vulnerabilities

CVE-2020-6429 Vulnerability in npm package electron

CVE-2020-7679 Vulnerability in npm package casperjs

CVE-2022-0122 Vulnerability in npm package node-forge

CVE-2019-20149 Vulnerability in maven package org.webjars.npm:kind-of

CVE-2022-21129 Vulnerability in npm package nemo-appium

Severity

Critical

Classification

CWE-78 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory