https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-20T18:22:16.346345+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-252215 EUVD-2026-252215 2026-10-20T18:22:16.348467+00:00 EUVD-2026-252215 https://cve.radiocsirt.org/vuln/fkie_cve-2025-57285 fkie_cve-2025-57285 2026-10-20T18:22:16.348497+00:00

codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function (lib/utils.js). The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands.

 https://cve.radiocsirt.org/vuln/ghsa-34w8-mcwr-vg29 GHSA-34w8-mcwr-vg29 — CodeceptJS's incomprehensive sanitation can lead to Command Injection 2026-10-20T18:22:16.348527+00:00

Affected: npm: codeceptjs

CodeceptJS versions 3.5.0 through 3.7.5-beta.18 contain a command injection vulnerability in the emptyFolder function (lib/utils.js). The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands.