{"id":"GHSA-gc94-6w89-hpqr","aliases":[],"status":"published","title":"Command Injection in fs-path","description":"All versions of `fs-path` are vulnerable to command injection is unsanitized user input is passed in.\n\n\n## Recommendation\n\nNo fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2019-06-12T16:37:07Z","modified":"2023-01-09T05:03:21Z","fixes":[{"ecosystem":"npm","package":"fs-path","fixed_in":["0.0.25"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"fs-path","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.25"}]}]},{"source":"osv","ecosystem":"npm","package":"fs-path","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.25"}]}]}],"references":[{"url":"https://hackerone.com/reports/324491","tags":["web"]},{"url":"https://www.npmjs.com/advisories/661","tags":["web"]},{"url":"https://github.com/pillys/fs-path/pull/5","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gc94-6w89-hpqr"},{"url":"https://github.com/pillys/fs-path","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-gc94-6w89-hpqr","title":"Command Injection in fs-path","description":"All versions of `fs-path` are vulnerable to command injection is unsanitized user input is passed in.\n\n\n## Recommendation\n\nNo fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.","status":"published","published":"2019-06-12T16:37:07Z","modified":"2023-01-09T05:03:21Z","cwes":["CWE-77"],"updated_at":"2026-11-02T14:36:05.071174Z"}],"osv":[{"id":"GHSA-gc94-6w89-hpqr","title":"Command Injection in fs-path","description":"All versions of `fs-path` are vulnerable to command injection is unsanitized user input is passed in.\n\n\n## Recommendation\n\nNo fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.","status":"published","published":"2019-06-12T16:37:07Z","modified":"2021-09-16T20:59:56Z","cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:47.822182Z"}]}}