What is GHSA-34w8-mcwr-vg29?

GHSA-34w8-mcwr-vg29 is a security advisory published by GitHub Security Advisories with Critical severity. CodeceptJS's incomprehensive sanitation can lead to Command Injection

Which CVE IDs does GHSA-34w8-mcwr-vg29 cover?

GHSA-34w8-mcwr-vg29 covers the following CVE IDs: CVE-2025-57285. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-34w8-mcwr-vg29?

GHSA-34w8-mcwr-vg29 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-34w8-mcwr-vg29?

GHSA-34w8-mcwr-vg29 affects 1 product, including: npm/codeceptjs:\u003e= 3.5.0, \u003c 3.7.5.

GHSA-34w8-mcwr-vg29CriticalCVSS 9.8

CodeceptJS's incomprehensive sanitation can lead to Command Injection

Vendor

GitHub Security Advisories

Published

September 8, 2025

Last Modified

September 23, 2025

🔗 CVE IDs covered (1)

CVE-2025-57285 →

📋 Description

CodeceptJS versions 3.5.0 through 3.7.5-beta.18 contain a command injection vulnerability in the emptyFolder function (lib/utils.js). The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands.

🎯 Affected products1

npm/codeceptjs:>= 3.5.0, < 3.7.5

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2025-57285
https://gist.github.com/Dremig/1ba111f9b1f7cffe1fcb4838b64e55b9
https://www.npmjs.com
https://github.com/codeceptjs/CodeceptJS/pull/3604
https://github.com/codeceptjs/CodeceptJS/pull/5190
https://github.com/advisories/GHSA-34w8-mcwr-vg29