CVE-2022-25923 (JSON, published 2023-01-06T05:15Z)
Description: value: Versions of the package exec-local-bin before 1.2.0 are vulnerable to Command Injection via the theProcess() functionality due to improper user-input sanitization.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/saeedseyfi/exec-local-bin
Files changed:
.gitignore
README.md
index.js
package-lock.json
package.json
Commit message: fixes(CVE-2022-25923): resolves command injection security issue


Vulnerable code:

Fixed code:
node_modules
# exec-local-bin
A simple helper to execute local node_module bin in node.

## Install
```bash
npm i exec-local-bin
```

## How to use
```node
const execLocalBin = require('exec-local-bin');

execLocalBin('relaxed') // runs: ./node_modules/.bin/relaxed
    .then((stdout) => console.log(stdout))
    .catch((error) => console.log(error));
```

## Arguments
- `bin`(required) = the executable file and the params
- `options`(optional) = can accept [child_process.exec options](https://nodejs.org/api/child_process.html#child_process_child_process_exec_command_options_callback)
const exec = require('child_process').exec;
const fs = require('fs');
const path = require('path');

module.exports = async function (bin, options) {
    return new Promise(async (resolve, reject) => {
        const binDir = `${process.cwd()}/node_modules/.bin`;
        const cmd = path.join(binDir, bin);

        if (!cmd.startsWith(binDir)) {
            reject(new Error(`${cmd} within the expected directory`));
            return;
        }

        try {
            await fs.access(cmd, fs.constants.X_OK);
        } catch (err) {
            reject(new Error(`${cmd} is not accessible: ${err.message}`));
            return;
        }

        console.log(`Running \`${cmd}\``);

        const theProcess = exec(cmd, options, (error, stdout, stderr) => {
            if (stderr) {
                reject(error);
                return;
            }

            resolve(stdout);
        });

        theProcess.stdout.on('data', (data) => {
            process.stdout.write(data.toString());
        });

        theProcess.stderr.on('data', (data) => {
            process.stdout.write(data.toString());
        });
    });
};
{
  "name": "exec-local-bin",
  "version": "1.1.1",
  "lockfileVersion": 1
}
{
  "name": "exec-local-bin",
  "version": "1.1.1",
  "description": "Helps you run local node binaries in node",
  "main": "index.js",
  "files": [
    "index.js"
  ],
  "engines": {
    "node": "^8.0.0"
  },
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "repository": {
    "type": "git",
    "url": "git+https://github.com/saeedseyfi/exec-local-bin.git"
  },
  "keywords": [
    "node",
    "exec",
    "local-bin",
    "node_modules"
  ],
  "author": "Saeed Seyfi <me@saeedseyfi.com> (http://saeedseyfi.com)",
  "license": "ISC",
  "bugs": {
    "url": "https://github.com/saeedseyfi/exec-local-bin/issues"
  },
  "homepage": "https://github.com/saeedseyfi/exec-local-bin#readme",
  "dependencies": {}
}