Description

The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param.

Remediation

References

https://github.com/nfriedly/node-bestzip/commit/45d4a901478c6a8f396c8b959dd6cf8fd3f955b6

https://snyk.io/vuln/SNYK-JS-BESTZIP-609371

Related Vulnerabilities

CVE-2020-6467 Vulnerability in maven package org.webjars.npm:electron

CVE-2022-0341 Vulnerability in npm package vditor

CVE-2021-32014 Vulnerability in npm package xlsx

CVE-2020-1926 Vulnerability in maven package org.apache.hive:hive-service

CVE-2020-8137 Vulnerability in npm package uppy

Severity

Critical

Classification

CWE-78

Tags

Patch Third Party Advisory