@vapi/node-yolo (>=1.2.0, <=1.2.5), node-yolo-shinobi (1.2.4) potentially affected by unknown CVE via imagickal (3.1.0)

imagickal NPM version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on imagickal and may be impacted: - @vapi/node-yolo =1.2.0, =1.2.5 - node-yolo-shinobi 1.2.4 Source cves: unknown CVE Source advisory: MEND:WS-2020-0440...

WS-2020-0440

In imagickal in versions 0.1.0 to 5.0.0 is vulnerable to RCE, it allows to execute arbitrary commands on the victim's PC...

Node.js third-party modules: [imagickal] Remote Code Execution

I would like to report RCE in imagickal It allows to execute arbitrary commands on the victim's PC Module module name: imagickal version: 4.2.0 npm page: https://www.npmjs.com/package/imagickal Module Description node wrapper for ImageMagick commands Module Stats 42 weekly downloads Vulnerability...