Vulnerability	Vulnerable Version
C Arbitrary Command Injection @ronomon/opened is a Check if a file is open in another application on Windows, macOS and Linux. Affected versions of this package are vulnerable to Arbitrary Command Injection. This allows a remote attacker to execute commands on the system if the library was used with untrusted input. The root cause of the problem is line 87 in `index.js`, which takes potential untrusted input as part of a string executed as a command by `child_process.exec()`. While the arguments are escaped by, an attacker could still bypass this sanitization because `child_process.exec()` will also interpret the string as a shell command. How to fix Arbitrary Command Injection? Upgrade `@ronomon/opened` to version 1.5.2 or higher.	<1.5.2

Arbitrary Command Injection

@ronomon/opened is a Check if a file is open in another application on Windows, macOS and Linux.

Affected versions of this package are vulnerable to Arbitrary Command Injection. This allows a remote attacker to execute commands on the system if the library was used with untrusted input.

The root cause of the problem is line 87 in index.js, which takes potential untrusted input as part of a string executed as a command by child_process.exec(). While the arguments are escaped by, an attacker could still bypass this sanitization because child_process.exec() will also interpret the string as a shell command.

How to fix Arbitrary Command Injection?

Upgrade @ronomon/opened to version 1.5.2 or higher.

<1.5.2

Go back to all versions of this package