@open-xchange/appsuite-codeceptjs (>=0.2.0, <=0.6.2), create-fintech-automation-test (>=1.0.4, <=1.0.5) +1 more potentially affected by CVE-2025-57285 via codeceptjs (>=3.6.2, <=3.6.10)

codeceptjs NPM version =3.6.2, =0.2.0, =1.0.4, =1.0.0, =1.0.4 Source cves: CVE-2025-57285 Source advisory: MEND:CVE-2025-57285...

CVE-2025-57285

codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands...

CVE-2025-57285

codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands...

CVE-2025-57285

The codeceptjs testing framework (versions 3.5.0 through 3.7.5-beta.18 ) is vulnerable to a command injection vulnerability in the emptyFolder function located in lib/utils.js. The root cause is that the execSync command directly concatenates the user-controlled directoryPath parameter without pr...

PT-2025-36489

Name of the Vulnerable Software and Affected Versions: codeceptjs version 3.7.3 Description: codeceptjs version 3.7.3 contains a command injection issue in the emptyFolder function located in lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter...

CVE-2025-57285

codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands...

CVE-2025-57285

codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands...

CodeceptJS security vulnerabilities

CodeceptJS is a testing framework from CodeceptJS open source. A security vulnerability exists in CodeceptJS version 3.7.3, which stems from a command injection in the emptyFolder function...

MAL-2025-7949 Malicious code in @frozen-team-qa/codeceptjs (npm)

The package @frozen-team-qa/codeceptjs was found to contain malicious code...

Malicious code in @frozen-team-qa/codeceptjs (npm)

The package @frozen-team-qa/codeceptjs was found to contain malicious code...

MAL-2023-197 Malicious code in codeceptjs-browserstack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 803e944b4406063368c8940d7f34221d26b1855be2d200abb731f20d97def026 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in codeceptjs-browserstack

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in codeceptjs-browserstack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 803e944b4406063368c8940d7f34221d26b1855be2d200abb731f20d97def026 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...