Executive brief
@floffah/build is a build tool that integrates with esbuild. A command injection vulnerability allows attackers to inject malicious commands through command-line options, potentially modifying build settings or executing arbitrary code during the build process.
Technical details
The vulnerability is a command injection issue (CWE-77) in how @floffah/build passes configuration to esbuild or estrella. The root cause is improper neutralization of special elements in command construction. An attacker who can control command-line arguments passed to the build tool can inject additional esbuild commands or options to alter build behavior or execute arbitrary code. The vulnerability affects all versions prior to v1.0.0, which patched the issue by using a proper method to pass configurations to the underlying build tools instead of shell string concatenation.
Affected products
- Floffah build <1.0.0
Timeline
- 2021-05-28: disclosed
- 2021-05-28: patched: Fixed in v1.0.0