create-choo-app3 is vulnerable to Command Injection via the devInstall function
- Severity:
- High
Description
All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 1.12.3
References
Related Issues
- Mermaid does not properly sanitize architecture diagram iconText leading to XSS - CVE-2025-54880
- Vue I18n Allows Prototype Pollution in `handleFlatJson` (GHSA-p2ph-7g93-hw3m) 5 - CVE-2025-27597
- Vue I18n Allows Prototype Pollution in `handleFlatJson` (GHSA-p2ph-7g93-hw3m) 4 - CVE-2025-27597
- Vue I18n Allows Prototype Pollution in `handleFlatJson` (GHSA-p2ph-7g93-hw3m) 3 - CVE-2025-27597
- Tags:
- npm
- create-choo-app3
Anything's wrong? Let us know Last updated on March 25, 2025