Description
docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within 'index.js' of the package, the function 'exec(serviceName, cmd, fnStdout, fnStderr, fnExit)' uses the variable 'serviceName' which can be controlled by users without any sanitization.
Remediation
References
https://snyk.io/vuln/SNYK-JS-DOCKERCOMPOSEREMOTEAPI-560125
Related Vulnerabilities
CVE-2022-46175 Vulnerability in maven package org.webjars.bower:json5
CVE-2020-13935 Vulnerability in maven package org.apache.tomcat:tomcat-coyote
CVE-2017-1000427 Vulnerability in maven package org.webjars.npm:marked
CVE-2017-3165 Vulnerability in maven package org.apache.brooklyn:brooklyn-jsgui
CVE-2022-36437 Vulnerability in maven package com.hazelcast.jet:hazelcast-jet