Executive brief
find-cypress-specs is a utility used to identify Cypress test files based on configuration settings. A security vulnerability in this tool allows an attacker to execute arbitrary commands on a system where the tool is running. This typically occurs if the tool is used in automated environments, like CI/CD pipelines, where an attacker can influence the name of a Git branch being processed. This could lead to unauthorized access to sensitive build environments or data.
Technical details
An OS command injection vulnerability exists in bahmutov find-cypress-specs up to version 1.54.12. The vulnerability is located in the Branch Handler component within `src/index.js`. The application uses `shell.exec()` to run Git commands, directly interpolating the user-provided `--branch` argument into the command string without proper sanitization or escaping. Because Git branch names can legally contain certain shell metacharacters (like semicolons or dollar signs), a local attacker or an attacker capable of influencing branch names in a CI/CD environment can achieve arbitrary code execution. As of the advisory date, the maintainer has been notified but no patch is currently available. Security engineers are advised to avoid using the `--branch` flag with untrusted input or to manually validate branch names against shell metacharacters.
Affected products
- bahmutov find-cypress-specs up to 1.54.12
Timeline
- 2026-06-17: disclosed: Issue reported to the maintainer on GitHub
- 2026-07-23: advisory: Vulnerability published by VulDB and NVD