Command Injection in buns

Overview

There is a command injection vulnerability in all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function install(requestedModule).

Recommendation

As there is no fixed version for buns and the package is marked deprecated, the current recommendation is to discontinue use of this package.

References

• GitHub Advisory
• Snyk Advisory