CVE-2022-25923: Other (NVD-CWE-Other)
value: Versions of the package exec-local-bin before 1.2.0 are vulnerable to Command Injection via the theProcess() functionality due to improper user-input sanitization.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 9.8
Published: 2023-01-06T05:15Z
Repository: https://github.com/saeedseyfi/exec-local-bin
Language: JSON
Files changed: .gitignore, README.md, index.js, package-lock.json, package.json
Commit date: 2023-01-04 17:43:01 +0100
Commit message: fixes(CVE-2022-25923): resolves command injection security issue

Diff: diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..3c3629e
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+node_modules
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..f9f6901
--- /dev/null
+++ b/README.md
@@ -0,0 +1,20 @@
+# exec-local-bin
+A simple helper to execute local node_module bin in node.
+
+## Install
+```bash
+npm i exec-local-bin
+```
+
+## How to use
+```node
+const execLocalBin = require('exec-local-bin');
+
+execLocalBin('relaxed') // runs: ./node_modules/.bin/relaxed
+    .then((stdout) => console.log(stdout))
+    .catch((error) => console.log(error));
+```
+
+## Arguments
+- `bin`(required) = the executable file and the params
+- `options`(optional) = can accept [child_process.exec options](https://nodejs.org/api/child_process.html#child_process_child_process_exec_command_options_callback)
\ No newline at end of file
diff --git a/index.js b/index.js
new file mode 100644
index 0000000..46bbfe0
--- /dev/null
+++ b/index.js
@@ -0,0 +1,41 @@
+const exec = require('child_process').exec;
+const fs = require('fs');
+const path = require('path');
+
+module.exports = async function (bin, options) {
+    return new Promise(async (resolve, reject) => {
+        const binDir = `${process.cwd()}/node_modules/.bin`;
+        const cmd = path.join(binDir, bin);
+
+        if (!cmd.startsWith(binDir)) {
+            reject(new Error(`${cmd} within the expected directory`));
+            return;
+        }
+
+        try {
+            await fs.access(cmd, fs.constants.X_OK);
+        } catch (err) {
+            reject(new Error(`${cmd} is not accessible: ${err.message}`));
+            return;
+        }
+
+        console.log(`Running \`${cmd}\``);
+
+        const theProcess = exec(cmd, options, (error, stdout, stderr) => {
+            if (stderr) {
+                reject(error);
+                return;
+            }
+
+            resolve(stdout);
+        });
+
+        theProcess.stdout.on('data', (data) => {
+            process.stdout.write(data.toString());
+        });
+
+        theProcess.stderr.on('data', (data) => {
+            process.stdout.write(data.toString());
+        });
+    });
+};
diff --git a/package-lock.json b/package-lock.json
new file mode 100644
index 0000000..6796aa6
--- /dev/null
+++ b/package-lock.json
@@ -0,0 +1,5 @@
+{
+  "name": "exec-local-bin",
+  "version": "1.1.1",
+  "lockfileVersion": 1
+}
diff --git a/package.json b/package.json
new file mode 100644
index 0000000..a765c17
--- /dev/null
+++ b/package.json
@@ -0,0 +1,32 @@
+{
+  "name": "exec-local-bin",
+  "version": "1.1.1",
+  "description": "Helps you run local node binaries in node",
+  "main": "index.js",
+  "files": [
+    "index.js"
+  ],
+  "engines": {
+    "node": "^8.0.0"
+  },
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/saeedseyfi/exec-local-bin.git"
+  },
+  "keywords": [
+    "node",
+    "exec",
+    "local-bin",
+    "node_modules"
+  ],
+  "author": "Saeed Seyfi <me@saeedseyfi.com> (http://saeedseyfi.com)",
+  "license": "ISC",
+  "bugs": {
+    "url": "https://github.com/saeedseyfi/exec-local-bin/issues"
+  },
+  "homepage": "https://github.com/saeedseyfi/exec-local-bin#readme",
+  "dependencies": {}
+}

Fixed code: node_modules
# exec-local-bin
A simple helper to execute local node_module bin in node.

## Install
```bash
npm i exec-local-bin
```

## How to use
```node
const execLocalBin = require('exec-local-bin');

execLocalBin('relaxed') // runs: ./node_modules/.bin/relaxed
    .then((stdout) => console.log(stdout))
    .catch((error) => console.log(error));
```

## Arguments
- `bin`(required) = the executable file and the params
- `options`(optional) = can accept [child_process.exec options](https://nodejs.org/api/child_process.html#child_process_child_process_exec_command_options_callback)
const exec = require('child_process').exec;
const fs = require('fs');
const path = require('path');

module.exports = async function (bin, options) {
    return new Promise(async (resolve, reject) => {
        const binDir = `${process.cwd()}/node_modules/.bin`;
        const cmd = path.join(binDir, bin);

        if (!cmd.startsWith(binDir)) {
            reject(new Error(`${cmd} within the expected directory`));
            return;
        }

        try {
            await fs.access(cmd, fs.constants.X_OK);
        } catch (err) {
            reject(new Error(`${cmd} is not accessible: ${err.message}`));
            return;
        }

        console.log(`Running \`${cmd}\``);

        const theProcess = exec(cmd, options, (error, stdout, stderr) => {
            if (stderr) {
                reject(error);
                return;
            }

            resolve(stdout);
        });

        theProcess.stdout.on('data', (data) => {
            process.stdout.write(data.toString());
        });

        theProcess.stderr.on('data', (data) => {
            process.stdout.write(data.toString());
        });
    });
};
{
  "name": "exec-local-bin",
  "version": "1.1.1",
  "lockfileVersion": 1
}
{
  "name": "exec-local-bin",
  "version": "1.1.1",
  "description": "Helps you run local node binaries in node",
  "main": "index.js",
  "files": [
    "index.js"
  ],
  "engines": {
    "node": "^8.0.0"
  },
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "repository": {
    "type": "git",
    "url": "git+https://github.com/saeedseyfi/exec-local-bin.git"
  },
  "keywords": [
    "node",
    "exec",
    "local-bin",
    "node_modules"
  ],
  "author": "Saeed Seyfi <me@saeedseyfi.com> (http://saeedseyfi.com)",
  "license": "ISC",
  "bugs": {
    "url": "https://github.com/saeedseyfi/exec-local-bin/issues"
  },
  "homepage": "https://github.com/saeedseyfi/exec-local-bin#readme",
  "dependencies": {}
}