Command Injection in create-choo-electron

Description

All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 2.0.0

References

• GHSA-j8wr-fwf2-vvr9
• security.snyk.io
• CVE-2022-25908
• CWE-77
• CWE-78
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Angular vulnerable to Cross-site Scripting - CVE-2020-7676
• rollbar vulnerable to prototype pollution - CVE-2025-57325
• csvjson vulnerable to prototype injection - CVE-2025-57318
• Prebid.js NPM package briefly compromised - CVE-2025-59038

Tags:

npm

create-choo-electron