GitHub Advisoryadvisory · npm

GHSA-jcgr-9698-82jx Improper Neutralization of Special Elements used in a Command ('Command Injection') in @floffah/build

LOW Published 2021-05-28 Modified 2021-05-27 Official page ↗
Ecosystem
npm
Packages
@floffah/build
Severity
Low
Weaknesses
CWE-77
Reviewed
2021-05-27

Affected packages

• npm @floffah/build: < 1.0.0 → fixed in 1.0.0

Description

Impact If you are using the esbuild target or command you are at risk of code/option injection. Attackers can use the command line option to maliciously change your settings in order to damage your project. Patches The problem has been patched in v1.0.0 as it uses a proper method to pass configs to esbuild/estrella. Workarounds There is no work around. You should update asap. Notes This notice is mainly just to make sure people update to the latest version. This isn't that bad, but should encourage you to update.

Related

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References