Description
The -s init- command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: true. A URL ending in -.git- bypasses the only input check, allowing OS command injection when a user runs -s init- with an attacker-controlled argument.
CVSS 9.8EPSS 1.045%Risk 1.07
View source- Published
- 2026-08-03 21:16:40
- Last modified
- 2026-08-06 22:17:41
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H