Description
im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument. The cmd argument used within index.js, can be controlled by user without any sanitization.
Remediation
References
https://github.com/Turistforeningen/node-im-resize/commit/de624dacf6a50e39fe3472af1414d44937ce1f03
https://snyk.io/vuln/SNYK-JS-IMRESIZE-544183
Related Vulnerabilities
CVE-2021-32808 Vulnerability in npm package ckeditor4
CVE-2023-35160 Vulnerability in maven package org.xwiki.platform:xwiki-platform-web-templates
CVE-2021-3312 Vulnerability in maven package org.opencms:opencms-core
CVE-2022-0722 Vulnerability in maven package org.webjars.npm:parse-url
CVE-2023-22899 Vulnerability in maven package net.lingala.zip4j:zip4j