CodeceptJS's incomprehensive sanitation can lead to Command Injection

Description

CodeceptJS versions 3.5.0 through 3.7.5-beta.18 contain a command injection vulnerability in the emptyFolder function (lib/utils.js). The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands.

Recommendation

Update the codeceptjs package to the latest compatible version. Followings are version details:

• Affected version(s): >= 3.5.0, < 3.7.5
• Patched version(s): 3.7.5

References

• GHSA-34w8-mcwr-vg29
• www.npmjs.com
• CVE-2025-57285
• CWE-77
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware - CVE-2025-59037
• The AuthKit React Router Library rendered sensitive auth data in HTML - CVE-2025-55008
• Vite allows server.fs.deny to be bypassed with .svg or relative paths - CVE-2025-31486
• tarteaucitron.js allows prototype pollution via custom text injection - CVE-2025-31475

Tags:

npm

codeceptjs