GHSA-cff4-rrq6-h78w
Command Injection in command-exists
Versions of command-exists before 1.2.4 are vulnerable to command injection. This is exploitable if user input is provided to this module.
Recommendation
Update to version 1.2.4 or later.
What each source reports
GitHub AdvisoriesNo score
Command Injection in command-exists
Versions of command-exists before 1.2.4 are vulnerable to command injection. This is exploitable if user input is provided to this module.
Recommendation
Update to version 1.2.4 or later.
- Record
GHSA-cff4-rrq6-h78w- Weakness
- CWE-77
- Updated
- 2026-11-02
OSVNo score
Command Injection in command-exists
Versions of command-exists before 1.2.4 are vulnerable to command injection. This is exploitable if user input is provided to this module.
Recommendation
Update to version 1.2.4 or later.
- Record
GHSA-cff4-rrq6-h78w- Weakness
- CWE-77
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
command-existsnpm | before 1.2.4 | 1.2.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-cff4-rrq6-h78w is a vulnerability with no CVSS score yet in command-exists, published June 3, 2019. No source lists public exploit code. Fixed in command-exists 1.2.4.