Command Injection Vulnerability in npm-programmatic by npm

CVE-2020-7614

What is CVE-2020-7614?

The npm-programmatic package, up to version 0.0.12, is susceptible to command injection vulnerabilities due to improper handling of user-supplied data. In the application, the concatenation of the packages and options properties occurs without validation, allowing an attacker to exploit the 'exec' function, potentially executing arbitrary commands on the host system. This flaw emphasizes the importance of proper input validation to mitigate risks associated with command injection.

References