Description
closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument "options" of the exports function in "index.js" can be controlled by users without any sanitization.
Remediation
References
https://snyk.io/vuln/SNYK-JS-CLOSURECOMPILERSTREAM-560123
Related Vulnerabilities
CVE-2020-7682 Vulnerability in npm package marked-tree
CVE-2022-0639 Vulnerability in npm package url-parse
CVE-2022-21169 Vulnerability in npm package express-xss-sanitizer
CVE-2021-21320 Vulnerability in npm package matrix-react-sdk
CVE-2023-31582 Vulnerability in maven package org.bitbucket.b_c:jose4j