{"id":"GHSA-jcgr-9698-82jx","summary":"Improper Neutralization of Special Elements used in a Command ('Command Injection') in @floffah/build","details":"### Impact\nIf you are using the esbuild target or command you are at risk of code/option injection. Attackers can use the command line option to maliciously change your settings in order to damage your project.\n\n### Patches\nThe problem has been patched in v1.0.0 as it uses a proper method to pass configs to esbuild/estrella.\n\n### Workarounds\nThere is no work around. You should update asap.\n\n### Notes\nThis notice is mainly just to make sure people update to the latest version. This isn't that bad, but should encourage you to update.","modified":"2021-05-27T21:05:29Z","published":"2021-05-28T15:53:40Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2021-05-27T21:05:29Z","nvd_published_at":null,"cwe_ids":["CWE-77"],"severity":"LOW"},"references":[{"type":"WEB","url":"https://github.com/Floffah/build/security/advisories/GHSA-jcgr-9698-82jx"}],"affected":[{"package":{"name":"@floffah/build","ecosystem":"npm","purl":"pkg:npm/%40floffah/build"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-jcgr-9698-82jx/GHSA-jcgr-9698-82jx.json"}}],"schema_version":"1.9.0"}