Description
All versions of curling.js are vulnerable to Command Injection via the run function. The command argument can be controlled by users without any sanitization.
Remediation
References
https://github.com/hgarcia/curling/blob/e861d625c074679a2931bcf4ce8da0afa8162c53/lib/curl-transport.js#L56
https://snyk.io/vuln/SNYK-JS-CURLING-546484
Related Vulnerabilities
CVE-2023-35165 Vulnerability in npm package aws-cdk-lib
CVE-2020-24750 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2020-8203 Vulnerability in npm package lodash
CVE-2021-31812 Vulnerability in maven package org.apache.pdfbox:pdfbox
CVE-2022-35915 Vulnerability in maven package org.webjars.npm:openzeppelin__contracts