CVE-2025-57285

codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands...

CVE-2025-57285

codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands...

CVE-2025-57285

CodeceptJS versions 3.5.0 through 3.7.5-beta.18 (specifically cited as 3.7.3 in several records) are vulnerable to a command injection vulnerability within the emptyFolder function located in lib/utils.js. The root cause is that the execSync command directly concatenates the user-controlled direc...