Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
fs-path node module before 0.0.25 is vulnerable to command injection by way of user-supplied inputs via the copy, copySync, remove, and removeSync methods.
Recommended action: Upgrade to 0.0.25 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
All versions of fs-path are vulnerable to command injection is unsanitized user input is passed in. Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.
Recommended action: Upgrade to 0.0.25 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.