CVE-2025-57285

CodeceptJS versions 3.5.0 through 3.7.5-beta.18 (specifically cited as 3.7.3 in several records) are vulnerable to a command injection vulnerability within the emptyFolder function located in lib/utils.js. The root cause is that the execSync command directly concatenates the user-controlled direc...