Ej2 Javascript Ui Controls
Monthly
OS command injection in Syncfusion ej2-javascript-ui-controls through version 33.2.3 allows a local attacker with low-privilege access to execute arbitrary operating system commands via unsanitized input passed to the child_process.exec function referenced in package.json. This is a build-time or script-execution sink, meaning exploitation is most likely during npm script invocation in developer workstations or CI/CD pipelines rather than in end-user browsers. A public proof-of-concept exists (GitHub issue #215); no CISA KEV listing is present, and the CVSS 4.0 score of 4.8 reflects limited real-world impact constrained to the local system.
OS command injection in Syncfusion ej2-javascript-ui-controls through version 33.2.3 allows a local attacker with low-privilege access to execute arbitrary operating system commands via unsanitized input passed to the child_process.exec function referenced in package.json. This is a build-time or script-execution sink, meaning exploitation is most likely during npm script invocation in developer workstations or CI/CD pipelines rather than in end-user browsers. A public proof-of-concept exists (GitHub issue #215); no CISA KEV listing is present, and the CVSS 4.0 score of 4.8 reflects limited real-world impact constrained to the local system.