CodeceptJS's incomprehensive sanitation can lead to Command Injection

Description

CodeceptJS versions 3.5.0 through 3.7.5-beta.18 contain a command injection vulnerability in the emptyFolder function (lib/utils.js). The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands.

Recommendation

Update the codeceptjs package to the latest compatible version. Followings are version details:

• Affected version(s): >= 3.5.0, < 3.7.5
• Patched version(s): 3.7.5

References

• GHSA-34w8-mcwr-vg29
• www.npmjs.com
• CVE-2025-57285
• CWE-77
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Strapi Password Hashing is Missing Maximum Password Length Validation - CVE-2025-25298
• Payload does not invalidate JWTs after log out (GHSA-5v66-m237-hwf7) 2 - CVE-2025-4643
• The AuthKit React Router Library rendered sensitive auth data in HTML - CVE-2025-55008
• Vite allows server.fs.deny to be bypassed with .svg or relative paths - CVE-2025-31486

Tags:

npm

codeceptjs