Description
This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which when the .image(), .svg() or .dot() functions are called, is executed by the childprocess.exec function.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | madge | unspecified – < 4.0.1 | 4.0.1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | madge | < 4.0.1 | 4.0.1 | GHSA-753c-phhg-cj29 |