Introduction Older versions of the package are vulnerable to Command Injection as an attacker controlled parameter. As a result, attackers may run malicious commands. Example PoC: const find = require("find-exec"); find("mplayer; touch hacked") This creates a file named "hacked" on the filesystem. You should never allow users to control commands to find, since this package attempts to run every command provided. Reference: https://github.com/advisories/GHSA-95rp-6gqp-6622 Mitigation To mitigate this issue, it is advised to upgrade your vulnerable package to the latest version. More specifically, upgrade the find-exec package to version 1.0.3 or higher. At the time of this writing, the latest version for this package was 1.0.3, so it is advised to upgrade to this version, to stay up-to-date with any emerging threats. Run the following command to patch the target: kali@kali:~/vicarius/a$ npm install --save find-exec@1.0.3 up to date, audited 66 packages in 4s 3 packages are looking for funding run `npm fund` for details 2 high severity vulnerabilities To address all issues (including breaking changes), run: npm audit fix --force Run `npm audit` for details. kali@kali:~/vicarius$ Detecting successful patching To detect the successful patching of the application, run the detection script again: kali@kali:~/vicarius$ bash detection.sh [-] The application seems to be patched against CVE-2023-40582. kali@kali:~/vicarius$ If the remediation script successfully finished, the output from the detection script should indicate the target has been successfully patched!