Description
devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The variable `commonName` controlled by user input is used as part of the `exec` function without any sanitization.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | devcert-sanscache | All versions prior to version 0.4.7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | devcert-sanscache | < 0.4.7 | 0.4.7 | GHSA-4gp3-p7ph-x2jr |