Description
serial-number through 1.3.0 allows execution of arbritary commands. The "cmdPrefix" argument in serialNumber function is used by the "exec" function without any validation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | serial-number | All versions including 1.3.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | serial-number | <= 1.3.0 | — | GHSA-3fw4-4h3m-892h |