Description
Versions of `gm` prior to 1.21.1 are affected by a command injection vulnerability. The vulnerability is triggered when user input is passed into `gm.compare()`, which fails to sanitize input correctly before calling the graphics magic binary.
## Recommendation
Update to version 1.21.1 or later.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | gm | < 1.21.1 | 1.21.1 | GHSA-pjh3-jv7w-9jpr |