22 matches found
MAL-2026-12236 Malicious code in tinkoff-codeceptjs-storyshots (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 253cf41e1be3d79a36e40038dd5e4776355c95c4eeb41aa40a0b4c7aa321c613 On require of this package, index.js unconditionally loads helpers.js, which at module load time downloads a platform-specific binary from...
Malicious code in tinkoff-codeceptjs-storyshots (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 253cf41e1be3d79a36e40038dd5e4776355c95c4eeb41aa40a0b4c7aa321c613 On require of this package, index.js unconditionally loads helpers.js, which at module load time downloads a platform-specific binary from...
MAL-2026-12237 Malicious code in tinkoff-codeceptjs-storyshots-alpha (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3112d2ca5a8472fa34cd7ca06332803889f72a195a05b3f98592e43decd66631 The package's index.js unconditionally requires bootstrap.js on load. bootstrap.js selects a platform-specific path linuxx64, linuxarm64, darwin,...
EUVD-2025-27152
Malicious code in bioql PyPI...
CVE-2025-57285
codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands...
@open-xchange/appsuite-codeceptjs (>=0.2.0, <=0.6.2), c-configure (>=1.0.1, <=2.1.5) +3 more potentially affected by CVE-2025-57285 via codeceptjs (>=3.0.7, <=3.6.10)
codeceptjs NPM version =3.0.7, =0.2.0, =1.0.1, =7.0.23, =1.0.4, =1.0.0, =1.0.4 Source cves: CVE-2025-57285 Source advisory: SNYK:JS-CODECEPTJS-12670804...
Arbitrary Command Injection
Overview codeceptjs is a Supercharged End 2 End Testing Framework for NodeJS Affected versions of this package are vulnerable to Arbitrary Command Injection via the emptyFolder function. An attacker can execute arbitrary system commands by supplying crafted input to the directoryPath parameter...
@open-xchange/appsuite-codeceptjs (>=0.2.0, <=0.6.2), create-fintech-automation-test (>=1.0.4, <=1.0.5) +1 more potentially affected by CVE-2025-57285 via codeceptjs (>=3.6.2, <=3.6.10)
codeceptjs NPM version =3.6.2, =0.2.0, =1.0.4, =1.0.0, =1.0.4 Source cves: CVE-2025-57285 Source advisory: OSV:GHSA-34W8-MCWR-VG29...
GHSA-34W8-MCWR-VG29 CodeceptJS's incomprehensive sanitation can lead to Command Injection
CodeceptJS versions 3.5.0 through 3.7.5-beta.18 contain a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary...
CodeceptJS's incomprehensive sanitation can lead to Command Injection
CodeceptJS versions 3.5.0 through 3.7.5-beta.18 contain a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary...
CVE-2025-57285
codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands...
CVE-2025-57285: Improper Neutralization of Special Elements used in a Command
codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands...
CVE-2025-57285
codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands...
CodeceptJS 安全漏洞
CodeceptJS is a testing framework from CodeceptJS open source. A security vulnerability exists in CodeceptJS version 3.7.3, which stems from a command injection in the emptyFolder function...
CVE-2025-57285
codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands...
CVE-2025-57285
The codeceptjs testing framework (versions 3.5.0 through 3.7.5-beta.18 ) is vulnerable to a command injection vulnerability in the emptyFolder function located in lib/utils.js. The root cause is that the execSync command directly concatenates the user-controlled directoryPath parameter without pr...
PT-2025-36489
Name of the Vulnerable Software and Affected Versions: codeceptjs version 3.7.3 Description: codeceptjs version 3.7.3 contains a command injection issue in the emptyFolder function located in lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter...
CVE-2025-57285
codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands...