Security vulnerabilities and automated fixes for path sanitization issues
1 post found
A high-severity command injection vulnerability in `scripts/generate-projects.js` allowed arbitrary code execution through unsanitized path inputs passed to `execSync()`. The fix replaces `execSync()` with `execFileSync()` and adds `path.basename()` sanitization, eliminating shell interpretation of malicious input.