Description
serial-number through 1.3.0 allows execution of arbritary commands. The "cmdPrefix" argument in serialNumber function is used by the "exec" function without any validation.
Remediation
References
https://github.com/es128/serial-number/blob/master/index.js#L106
https://snyk.io/vuln/SNYK-JS-SERIALNUMBER-559010
Related Vulnerabilities
CVE-2023-24057 Vulnerability in maven package ca.uhn.hapi.fhir:org.hl7.fhir.r5
CVE-2020-14060 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2017-16052 Vulnerability in npm package node-fabric
CVE-2022-45397 Vulnerability in maven package org.jenkins-ci.plugins:osf-builder-suite-xml-linter