CVE-2025-57285: CodeceptJS's incomprehensive sanitation can lead to Command Injection

September 8, 2025 (updated September 23, 2025)

CodeceptJS versions 3.5.0 through 3.7.5-beta.18 contain a command injection vulnerability in the emptyFolder function (lib/utils.js). The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands.

References

gist.github.com/Dremig/1ba111f9b1f7cffe1fcb4838b64e55b9
github.com/advisories/GHSA-34w8-mcwr-vg29
github.com/codeceptjs/CodeceptJS
github.com/codeceptjs/CodeceptJS/pull/3604
github.com/codeceptjs/CodeceptJS/pull/5190
nvd.nist.gov/vuln/detail/CVE-2025-57285
www.npmjs.com/

Code Behaviors & Features

Detect and mitigate CVE-2025-57285 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →