CRITICAL 9.8
GHSA-f8fh-8rgm-227h
OS Command Injection in node-prompt-here
Details
node-prompt-here through 1.0.1 allows execution of arbitrary commands. The `runCommand()` is called by `getDevices()` function in file `linux/manager.js`, which is required by the `index. process.env.NM_CLI` in the file `linux/manager.js`. This function is used to construct the argument of function `execSync()`, which can be controlled by users without any sanitization.
Are you affected?
Enter the version of the package you're using.
Affected packages
npm / node-prompt-here
Introduced in:
0 No fixed version published yet for node-prompt-here (npm). Pin to a known-safe version or switch to an alternative.