{"id":"GHSA-4qqc-mp5f-ccv4","summary":"Command Injection in bestzip","details":"Versions of `bestzip` prior to 2.1.7 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an `exec` call on the `zip` function . This may allow attackers to execute arbitrary code in the system as long as the values of `destination` is user-controlled. This only affects users with a native `zip` command available. The following examples demonstrate the issue from the CLI and also programatically:\n- `bestzip test.zip 'sourcefile; mkdir folder'`\n- `zip({ source: 'sourcefile', destination: './test.zip; mkdir folder' })`","modified":"2020-09-02T15:04:08Z","published":"2020-09-02T15:05:51Z","database_specific":{"cwe_ids":["CWE-77"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2020-09-02T15:04:08Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://www.npmjs.com/advisories/1554"}],"affected":[{"package":{"name":"bestzip","ecosystem":"npm","purl":"pkg:npm/bestzip"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.7"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-4qqc-mp5f-ccv4/GHSA-4qqc-mp5f-ccv4.json"}}],"schema_version":"1.9.0"}