<p>There is no fixed version for <code>deferred-exec</code>.</p>

Command Injection Affecting deferred-exec package, versions *

Attack Complexity Low

Confidentiality High

Integrity High

Availability High

Exploit Maturity Proof of concept

EPSS 0.25% (65^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

How to fix?

There is no fixed version for deferred-exec.

deferred-exec is a tool to run exec commands. Lets you use exec, execFile and spawn in a sane way.

Affected versions of this package are vulnerable to Command Injection. The injection point is located in line 42 in lib/deferred-exec.js

var a = require("deferred-exec");
a(" touch JHU ",{});