Homepage

bun@1.2.19 vulnerabilities

Bun is a fast all-in-one JavaScript runtime.

  • latest version

    1.2.19

  • latest non vulnerable version

    0.0.12

  • first published

    12 years ago

  • latest version published

    9 days ago

  • licenses detected

  • View bun package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the bun package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

    Affected versions of this package are vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the $ shell API due to improper neutralization of user input. An attacker can exploit this by providing specially crafted input that includes command-line arguments or shell metacharacters, leading to unintended command execution.

    Note: This issue relates to the widely known and actively developed 'Bun' JavaScript runtime. The bun package on NPM at versions 0.0.12 and below belongs to a different and older project that happened to claim the 'bun' name in the past.

    How to fix Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')?

    There is no fixed version for bun.

    >0.0.12
    Go back to all versions of this package