Command Injection

Overview xopen is a package that provides a dead-simple Promise API for opening files from Node on Windows, macOS, and Linux. Affected versions of this package are vulnerable to Command Injection. The injection point is located in line 14 in index.js in the exported function xopenfilepath PoC: va...