@akashic/engine-files-reftest (>=3.3.20 <=3.4.1-beta.4), @astound/appium-xcuitest-driver (=2.67.1) +66 more potentially affected by unknown CVE via node-idevice (=0.1.6)

node-idevice NPM version =0.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on node-idevice and may be impacted: - @akashic/engine-files-reftest =3.3.20, =0.1.0, =0.1.0-alpha.0, =0.8.0, =1.9.2-beta2.15, =0.1.5, =0.0.34, =5.7.8, =0.0.0-fake.230, =0.0.1...

Command Injection

Overview node-idevice is an Install apps on your ios device. Node wrapper around ideviceinstaller. Affected versions of this package are vulnerable to Command Injection. It is possible to inject arbitrary commands by using a semicolon char while declaring the udid on IDevice. Remediation There is...