Executive brief
gulp-tape is a Node.js module that integrates the Tape testing framework into Gulp build pipelines. The package allows attackers to inject and execute arbitrary operating system commands by crafting malicious options, potentially compromising the build environment and any systems running affected builds.
Technical details
The vulnerability is an OS command injection (CWE-78) in gulp-tape's options processing, where user-supplied option values are not properly sanitized before being passed to shell execution. An attacker can inject shell metacharacters (e.g., "&" or ";") within options like the "name" parameter to execute arbitrary commands. The attack is network-adjacent or local depending on how options are sourced (e.g., from user input, configuration files, or dependency chains). There is no patched version available; the vulnerability affects all versions through 1.0.0, and the project appears to lack an active maintenance response.
Affected products
- gulp-tape gulp-tape through 1.0.0
Timeline
- 2020-03-13: disclosed
- 2021-05-07: advisory