Description
A command injection vulnerability in the `devcert` module may lead to remote code execution when users of the module pass untrusted input to the `certificateFor` function.
Remediation
References
https://hackerone.com/reports/863544
Related Vulnerabilities
CVE-2017-16171 Vulnerability in npm package hcbserver
CVE-2020-7703 Vulnerability in npm package nis-utils
CVE-2013-4152 Vulnerability in maven package org.springframework:spring-web
CVE-2018-6561 Vulnerability in maven package org.webjars.bower:dijit
CVE-2022-24999 Vulnerability in maven package org.webjars.bower:qs