Category

Child Process

Security vulnerabilities and automated fixes for child process issues

43 posts found

high9 min

How Command Injection Happens in Node.js child_process and How to Fix It

A high-severity command injection vulnerability was discovered in `server.js` where user-controlled file paths were passed directly to shell commands via `exec()`. By migrating from `exec()` to `execFile()` and using argument arrays instead of string concatenation, the fix eliminates the attack surface while preserving the intended trash/delete functionality across macOS, Windows, and Linux.

#command-injection#nodejs#child-process+2 more
A
anupamme
Sep 7, 2026
high7 min

How Command Injection happens in Node.js and how to fix it

A semgrep scan flagged `scripts/postinstall.js` for calling `child_process.execSync` in a way that could become a command injection primitive if the script's execution context ever changed. The fix hardens the script by guarding its side effects behind a `require.main === module` check, introducing the safer `execFileSync` API, and adding automated tests to lock in the safe behavior.

#command-injection#nodejs#javascript+3 more
A
anupamme
Sep 7, 2026
high4 min

How command injection happens in Node.js child_process and how to fix it

A critical command injection vulnerability in `scripts/check-links.js` was fixed by replacing `execSync()` with `execFileSync()`, eliminating shell interpretation of user-controlled repository names. This proactive hardening prevents potential remote code execution in the GitHub CLI integration workflow.

#command-injection#nodejs#child-process+3 more
A
anupamme
Sep 7, 2026
high5 min

How command injection happens in JavaScript child_process and how to fix it

A high-severity command injection vulnerability in Claude Code's `prepare-native.js` could have allowed attackers to execute arbitrary shell commands through malicious npm package tarball URLs. The fix adds strict URL scheme validation and proper curl argument termination to neutralize injection vectors.

#command-injection#javascript#nodejs+4 more
A
anupamme
Sep 7, 2026
high6 min

How Command Injection Happens in Node.js Child Process Calls and How to Fix It

The Spotify CLI contained a command injection vulnerability in its browser-opening functionality, where user-controlled URLs were passed directly to `exec()` with shell interpretation enabled. By switching from `exec()` to `execFile()` and properly structuring command arguments, the fix eliminates the attack surface while maintaining cross-platform compatibility.

#command-injection#javascript#nodejs+2 more
A
anupamme
Sep 7, 2026
high6 min

How command injection happens in JavaScript/Node.js and how to fix it

A build script in a Node.js library used `child_process.exec()` with template-literal-interpolated commit hashes to generate SVG diffs, creating a command injection primitive. The fix replaces `exec()` with `execFile()` and adds strict regex validation of commit hashes before they're used in any shell command.

#command-injection#javascript#nodejs+3 more
A
anupamme
Sep 7, 2026
high5 min

How javascript.lang.security.detect-child-process.detect-child-process happens in Node.js and how to fix it

A high-severity command injection vulnerability was discovered in `packages/runner/src/main.js` where the `child_process.spawn()` function accepted an unvalidated `argv` array parameter. An attacker could potentially inject malicious arguments to execute arbitrary commands. The fix adds strict type validation for the `argv` array and explicitly disables shell execution to prevent command injection attacks.

#command-injection#javascript#nodejs+3 more
A
anupamme
Sep 6, 2026
high5 min

How javascript.lang.security.detect-child-process.detect-child-process happens in Node.js and how to fix it

A command injection vulnerability was discovered in `scripts/install.js` where user-controllable input was passed to `child_process.execSync()` through string interpolation. This high-severity issue could allow attackers to execute arbitrary shell commands by crafting malicious package file paths. The fix replaces `execSync()` with `execFileSync()`, which bypasses the shell entirely and treats arguments as literal values.

#command-injection#nodejs#javascript+3 more
A
anupamme
Sep 1, 2026
high6 min

How Command Injection Happens in Node.js child_process and How to Fix It

A high-severity command injection vulnerability in `scripts/generate-projects.js` allowed arbitrary code execution through unsanitized path inputs passed to `execSync()`. The fix replaces `execSync()` with `execFileSync()` and adds `path.basename()` sanitization, eliminating shell interpretation of malicious input.

#command-injection#nodejs#child-process+3 more
A
anupamme
Aug 31, 2026
high7 min

How Command Injection happens in Node.js Child Process Calls and how to fix it

A critical command injection vulnerability was discovered in `lyricVideoExport.js` where user-controlled input could be passed unsafely to Node.js child process calls. The fix establishes explicit trust boundaries, uses `shell:false`, and passes arguments as an array instead of a concatenated string, preventing attackers from injecting arbitrary commands.

#command-injection#nodejs#javascript+3 more
A
anupamme
Aug 31, 2026
high6 min

How command injection happens in Node.js child_process spawn calls and how to fix it

A benchmarking helper in `bench/lib/actor.js` passed an unvalidated executable path from upstream pipeline results directly into `child_process.spawn()`. The fix resolves the path and enforces that it lives inside the sandboxed stage directory before execution, closing off a path-traversal-driven command injection primitive.

#command-injection#path-traversal#nodejs+3 more
A
anupamme
Aug 31, 2026
high7 min

How Command Injection Happens in Node.js `child_process` and How to Fix It

A critical command injection vulnerability in `src/git.js` allowed potential shell command execution through unsanitized branch names. The fix replaces `exec()` with `execFile()`, eliminates shell interpretation, and removes regex-based interpolation that could inject malicious commands.

#command-injection#nodejs#child-process+3 more
A
anupamme
Aug 31, 2026