{"id":"GHSA-cff4-rrq6-h78w","aliases":[],"status":"published","title":"Command Injection in command-exists","description":"Versions of `command-exists` before 1.2.4 are vulnerable to command injection. This is exploitable if user input is provided to this module.\n\n\n## Recommendation\n\nUpdate to version 1.2.4 or later.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2019-06-03T17:31:26Z","modified":"2023-04-03T21:59:36Z","fixes":[{"ecosystem":"npm","package":"command-exists","fixed_in":["1.2.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"command-exists","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4"}]}]},{"source":"osv","ecosystem":"npm","package":"command-exists","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.2.4"}]}]}],"references":[{"url":"https://hackerone.com/reports/324453","tags":["web"]},{"url":"https://github.com/mathisonian/command-exists/blob/v1.2.2/lib/command-exists.js#L49-L94","tags":["web"]},{"url":"https://www.npmjs.com/advisories/659","tags":["web"]},{"url":"https://github.com/mathisonian/command-exists/commit/7ca91ba71604df6817a28c93d7776af9c49c431a","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cff4-rrq6-h78w"}],"sources":{"ghsa":[{"id":"GHSA-cff4-rrq6-h78w","title":"Command Injection in command-exists","description":"Versions of `command-exists` before 1.2.4 are vulnerable to command injection. This is exploitable if user input is provided to this module.\n\n\n## Recommendation\n\nUpdate to version 1.2.4 or later.","status":"published","published":"2019-06-03T17:31:26Z","modified":"2023-04-03T21:59:36Z","cwes":["CWE-77"],"updated_at":"2026-11-02T14:36:49.768564Z"}],"osv":[{"id":"GHSA-cff4-rrq6-h78w","title":"Command Injection in command-exists","description":"Versions of `command-exists` before 1.2.4 are vulnerable to command injection. This is exploitable if user input is provided to this module.\n\n\n## Recommendation\n\nUpdate to version 1.2.4 or later.","status":"published","published":"2019-06-03T17:31:26Z","modified":"2020-08-31T18:31:41Z","cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:44.927642Z"}]}}