Older versions of the package are vulnerable to Command Injection as an attacker controlled parameter. As a result, attackers may run malicious commands.

For example:

const find = require("find-exec");
find("mplayer; touch hacked")

This creates a file named "hacked" on the filesystem.

You should never allow users to control commands to find, since this package attempts to run every command provided.

Thanks to @miguelafmonteiro for reporting.

References

• GHSA-95rp-6gqp-6622
• https://nvd.nist.gov/vuln/detail/CVE-2023-40582
• shime/find-exec@74fb108