CVE-2025-57285

codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands...

CVE-2025-57285

codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands...

CVE-2025-57285

CVE-2025-57285 affects CodeceptJS 3.7.3, where the emptyFolder function in lib/utils.js uses execSync with a user-controlled directoryPath unsafely, enabling potential command execution. The IBM and OSSV/GHSA entries corroborate the vulnerability in CodeceptJS and note versions around 3.5.0–3.7.5...