projen 0.3.3

Direct Vulnerabilities

Known vulnerabilities in the projen package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Command Injection projen is a CDK for software projects Affected versions of this package are vulnerable to Command Injection in the task synthesis, which interpolates configuration properties and auto-discovered file names into the generated `.projen/tasks.json` without escaping shell metacharacters, affecting properties including `extraArgs`, `testMatch`, `entrypoint`, `registryUrl`, and `distdir`. An attacker who can influence project configuration or repository file names, as a contributor or by adding a file whose name carries shell metacharacters such as `;`, `&&`, `$(...)`, or backticks, can execute commands with the filesystem access and secrets of a developer workstation or CI runner. This requires the ability to modify configuration or contribute files, and execution occurs when an affected task runs, which spans the project lifecycle from `test` and `eslint` through `release` and `publish:`. Note:* The project maintainers advise that "After upgrading, you must re-synthesize your project to regenerate .projen/tasks.json with the corrected task definitions." How to fix Command Injection? Upgrade `projen` to version 0.103.0 or higher.	<0.103.0
M Relative Path Traversal projen is a CDK for software projects Affected versions of this package are vulnerable to Relative Path Traversal in the manifest cleanup routine that processes `.projen/files.json` during synthesis, which resolves each manifest entry against the project directory with `path.resolve()` without verifying that the result remains inside that directory. An attacker can cause recursive deletion of arbitrary files and directories writable by the environment running projen, by placing an entry containing `../` sequences or an absolute path in `.projen/files.json`, which then reaches `fs.rmSync()` with recursion enabled. This requires the attacker to influence `.projen/files.json` through a direct commit or a pull request that triggers CI synthesis, and the deletion is bounded to paths writable by that process. How to fix Relative Path Traversal? Upgrade `projen` to version 0.101.37 or higher.	<0.101.37

Vulnerability

Vulnerable Version

Command Injection

projen is a CDK for software projects

Affected versions of this package are vulnerable to Command Injection in the task synthesis, which interpolates configuration properties and auto-discovered file names into the generated .projen/tasks.json without escaping shell metacharacters, affecting properties including extraArgs, testMatch, entrypoint, registryUrl, and distdir. An attacker who can influence project configuration or repository file names, as a contributor or by adding a file whose name carries shell metacharacters such as ;, &&, $(...), or backticks, can execute commands with the filesystem access and secrets of a developer workstation or CI runner. This requires the ability to modify configuration or contribute files, and execution occurs when an affected task runs, which spans the project lifecycle from test and eslint through release and publish:*.

Note: The project maintainers advise that "After upgrading, you must re-synthesize your project to regenerate .projen/tasks.json with the corrected task definitions."

How to fix Command Injection?

Upgrade projen to version 0.103.0 or higher.

<0.103.0

Relative Path Traversal

projen is a CDK for software projects

Affected versions of this package are vulnerable to Relative Path Traversal in the manifest cleanup routine that processes .projen/files.json during synthesis, which resolves each manifest entry against the project directory with path.resolve() without verifying that the result remains inside that directory. An attacker can cause recursive deletion of arbitrary files and directories writable by the environment running projen, by placing an entry containing ../ sequences or an absolute path in .projen/files.json, which then reaches fs.rmSync() with recursion enabled. This requires the attacker to influence .projen/files.json through a direct commit or a pull request that triggers CI synthesis, and the deletion is bounded to paths writable by that process.

How to fix Relative Path Traversal?

Upgrade projen to version 0.101.37 or higher.

<0.101.37

projen@0.3.3

CDK for software projects

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically