Command Injection

Overview props is an extract json/yaml from the beginning of text files Affected versions of this package are vulnerable to Command Injection due to Unsafe Deserialization in props module. The module uses yaml-js.load function to load a YAML file without any validation/sanitization. If an attacke...