EUVD-2026-48281
GHSA-4rrx-2jjh-rw9q
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack vector (AV:L), limited user privileges needed (PR:L), scope unchanged, and low impact across all three pillars consistent with CVSS 4.0 source vector.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.exec of the file src/index.js of the component Branch Handler. This manipulation of the argument --branch causes os command injection. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
OS command injection in bahmutov/find-cypress-specs versions through 1.54.12 allows a local attacker with limited privileges to execute arbitrary shell commands by supplying a crafted value to the --branch argument, which is passed unsanitized to shell.exec in src/index.js. The vulnerability is constrained to local execution and carries low impact across confidentiality, integrity, and availability per the CVSS 4.0 vector. A public proof-of-concept exists and the vendor has not responded to the coordinated disclosure report filed via GitHub issue #423; no patch has been released at time of analysis.
Technical ContextAI
find-cypress-specs is a Node.js developer utility by Gleb Bahmutov used to enumerate Cypress end-to-end test specification files within a repository. The Branch Handler component in src/index.js invokes shell.exec - likely via a library such as shelljs - to run Git or environment-inspection commands that incorporate the --branch argument. CWE-77 (Improper Neutralization of Special Elements used in a Command) describes the root cause: the branch value is concatenated into a shell command string without escaping metacharacters such as semicolons, pipes, backticks, or $() substitutions, enabling the injected fragment to be interpreted as a separate shell directive. Because this is a CLI development tool rather than a network-exposed service, the realistic attack surface is primarily CI/CD pipelines, shared developer workstations, or build environments where an adversary can influence command-line arguments.
RemediationAI
No vendor-released patch has been identified at time of analysis - the maintainer has not responded to the coordinated disclosure filed at GitHub issue #423. Upstream fix availability should be monitored at https://github.com/bahmutov/find-cypress-specs/. As a compensating control, restrict the --branch argument to trusted, validated values by wrapping invocations in input-validation logic that allows only alphanumeric characters, hyphens, and forward slashes (a strict allowlist covering standard Git branch naming). Alternatively, replace shell.exec calls with a child_process.execFile or child_process.spawn invocation that passes arguments as an array rather than an interpolated string, which prevents shell metacharacter interpretation entirely - this is the architecturally sound fix and avoids the CWE-77 class entirely. In shared CI environments, restrict who or what pipeline stage can supply the --branch value. Pinning to a known-safe version prior to any future patched release provides no mitigation since all versions through 1.54.12 are affected.
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today