HIGH
GHSA-wqhw-frpx-5mmp
Command Injection in tomato
Details
All versions of `tomato` are vulnerable to Command Injection. The /api/exec endpoint does not validate user input allowing attackers to run arbitrary commands in the system.
## Recommendation
No fix is currently available. Consider using an alternative module until a fix is made available.
Are you affected?
Enter the version of the package you're using.
Affected packages
npm/tomato
Introduced in:
0No fixed version published yet for tomato (npm). Pin to a known-safe version or switch to an alternative.