CVE-2025-57285

codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands...

CVE-2025-57285

codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands...

CVE-2025-57285

The codeceptjs testing framework (versions 3.5.0 through 3.7.5-beta.18 ) is vulnerable to a command injection vulnerability in the emptyFolder function located in lib/utils.js. The root cause is that the execSync command directly concatenates the user-controlled directoryPath parameter without pr...