Wjm2

**Name of the Vulnerable Software and Affected Versions** localstack serverless-localstack versions prior to 1.4.1 **Description** An OS command injection issue exists within the Configuration Handler component in the `src/index.js` file. This occurs when the `custom.localstack.docker.compose file` argument is manipulated, allowing for the execution of arbitrary operating system commands. This issue requires local access to be exploited. **Recommendations** Update localstack serverless-localstack to a version newer than 1.4.0. Avoid using the `custom.localstack.docker.compose file` argument until the software is updated.

**Name of the Vulnerable Software and Affected Versions** bahmutov find-cypress-specs versions prior to 1.54.13 **Description** An OS command injection flaw exists in the Branch Handler component within the `shell.exec()` function located in the `src/index.js` file. This issue occurs when the `--branch` argument is manipulated, allowing for local execution of arbitrary commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** release-it conventional-changelog versions prior to 11.0.2 **Description** An OS command injection flaw exists in the Changelog File Handler component within the `writeChangelog()` function of the `index.js` file. A local attacker can exploit this by manipulating the `infile` argument to execute arbitrary operating system commands. **Recommendations** Update release-it conventional-changelog to version 11.0.2 or later. As a temporary mitigation, restrict local access to the system to prevent unauthorized users from manipulating the `infile` argument.

**Name of the Vulnerable Software and Affected Versions** danger danger-js versions prior to 13.0.8 **Description** An OS command injection issue exists in the CLI component within the `danger.git.diffForFile()` function located in the `source/platforms/git/localGetFileAtSHA.ts` file. This occurs when the `File` argument is manipulated, allowing a local attacker to execute arbitrary operating system commands. **Recommendations** Upgrade to version 13.0.8. As a temporary workaround, restrict the use of the `danger.git.diffForFile()` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** publint versions prior to 0.1.5 **Description** An OS command injection issue exists within the package-manager Command Handler component. The flaw is located in the `child process.exec()` function within the `src/node/pack.js` file. This allows for the execution of arbitrary operating system commands, provided the attacker has local access. OS command injection is a flaw where an application passes unsafe user-supplied data to a system shell, allowing the execution of unauthorized commands. **Recommendations** Apply patch adf2d9a09945fc98c85a2520a89f441d78b2dbd8 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** syncfusion ej2-javascript-ui-controls versions prior to 33.2.4 **Description** An OS command injection flaw exists when the software is accessed locally. The issue resides in the `child process.exec()` function within the `package.json` file, where improper manipulation allows the execution of arbitrary operating system commands. **Recommendations** Update syncfusion ej2-javascript-ui-controls to version 33.2.4 or later.

**Name of the Vulnerable Software and Affected Versions** umijs umi versions prior to 4.6.64 **Description** An OS command injection flaw exists within the GIT File Helper component. The issue resides in the `git.getFileCreateInfo()` function located in the `packages/utils/src/getFileGitIno.ts` file, where improper manipulation allows for the execution of arbitrary operating system commands. **Recommendations** Update to version 4.6.64. As a temporary mitigation, restrict the use of the `git.getFileCreateInfo()` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** oclif versions prior to 4.23.17 **Description** An OS command injection issue exists in the JIT Plugin Entry Handler component. A local attacker can manipulate the `jitPlugins` argument to execute arbitrary commands via the `child process.exec()` function. **Recommendations** Deploy patch 939b045725e065baebc4587b8bccfd56731eed3d for versions prior to 4.23.17.

**Name of the Vulnerable Software and Affected Versions** jsforce versions prior to 3.10.17 **Description** An OS command injection issue exists within the SFDX Connection Registry component. The flaw is located in the ` execCommand()` function within the `lib/registry/sfdx.js` library. This allows for the execution of arbitrary operating system commands, although the attack can only be performed from a local environment. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the ` execCommand()` function in the `lib/registry/sfdx.js` library to minimize the risk of exploitation.