CodeceptJS's incomprehensive sanitation can lead to Command Injection

Description

CodeceptJS versions 3.5.0 through 3.7.5-beta.18 contain a command injection vulnerability in the emptyFolder function (lib/utils.js). The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands.

Recommendation

Update the codeceptjs package to the latest compatible version. Followings are version details:

• Affected version(s): >= 3.5.0, < 3.7.5
• Patched version(s): 3.7.5

References

• GHSA-34w8-mcwr-vg29
• www.npmjs.com
• CVE-2025-57285
• CWE-77
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• BrowserStack Local vulnerable to Command Injection through logfile variable - CVE-2025-57283
• Matrix IRC Bridge allows IRC command injection to own puppeted user - CVE-2025-27146
• Happy DOM: VM Context Escape can lead to Remote Code Execution - CVE-2025-61927
• systeminformation has a Command Injection vulnerability in fsSize() function on Windows - CVE-2025-68154

Tags:

npm

codeceptjs