Description
All versions of curling.js are vulnerable to Command Injection via the run function. The command argument can be controlled by users without any sanitization.
Remediation
References
https://github.com/hgarcia/curling/blob/e861d625c074679a2931bcf4ce8da0afa8162c53/lib/curl-transport.js#L56
https://snyk.io/vuln/SNYK-JS-CURLING-546484
Related Vulnerabilities
CVE-2021-42767 Vulnerability in maven package org.neo4j.procedure:apoc
CVE-2014-3603 Vulnerability in maven package org.opensaml:opensaml
CVE-2021-25329 Vulnerability in maven package org.apache.tomcat:tomcat-catalina
CVE-2020-7627 Vulnerability in npm package node-key-sender
CVE-2022-23458 Vulnerability in maven package org.webjars.npm:tui-grid