CVE-2021-32684: Always-Incorrect Control Flow Implementation (CWE-670)
value: magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Magento 2. In versions 1.5.1 and 1.5.2, after changing the function from synchronous to asynchronous there wasn't implemented handler in the start, stop, exec, and logs commands, effectively making them unusable. Version 1.5.3 contains patches for the problems.
CWE description: The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
CVSS v3 base score: 5.5
Published: 2021-06-14T23:15Z
Repository: https://github.com/scandipwa/create-magento-app
Language: JavaScript
Files changed: build-packages/magento-scripts/lib/commands/execute.js, build-packages/magento-scripts/lib/commands/logs.js
Commit date: 2021-06-08 16:37:58 +0300
Commit message: fixed exec and logs command throwing an error with docker.getContainers

Diff: diff --git a/build-packages/magento-scripts/lib/commands/execute.js b/build-packages/magento-scripts/lib/commands/execute.js
index 42d0808..365c199 100644
--- a/build-packages/magento-scripts/lib/commands/execute.js
+++ b/build-packages/magento-scripts/lib/commands/execute.js
@@ -2,11 +2,11 @@ const logger = require('@scandipwa/scandipwa-dev-utils/logger');
 const { docker } = require('../config');
 const executeInContainer = require('../tasks/execute');
 
 module.exports = (yargs) => {
     yargs.command('exec <container name> [commands...]', 'Execute command in docker container', () => {}, async (argv) => {
-        const containers = docker.getContainers();
+        const containers = (await docker).getContainers();
         const services = Object.keys(containers);
 
         if (services.includes(argv.containername) || services.some((service) => service.includes(argv.containername))) {
             const container = containers[argv.containername]
                 ? containers[argv.containername]
diff --git a/build-packages/magento-scripts/lib/commands/logs.js b/build-packages/magento-scripts/lib/commands/logs.js
index 3f8d917..25eb8f3 100644
--- a/build-packages/magento-scripts/lib/commands/logs.js
+++ b/build-packages/magento-scripts/lib/commands/logs.js
@@ -58,11 +58,11 @@ module.exports = (yargs) => {
                     type: 'string'
                 }
             );
         },
         async (argv) => {
-            const containers = docker.getContainers();
+            const containers = (await docker).getContainers();
             const services = Object.keys(containers);
 
             if (services.includes(argv.scope) || services.some((service) => service.includes(argv.scope))) {
                 const containerName = containers[argv.scope] ? argv.scope : Object.keys(containers).find((key) => key.includes(argv.scope));
                 const commandArguments = [

Vulnerable code:         const containers = docker.getContainers();
            const containers = docker.getContainers();
Fixed code:         const containers = (await docker).getContainers();
            const containers = (await docker).getContainers();