Command Injection Vulnerability in @floffah/build
Summary
GHSA-jcgr-9698-82jx: Improper Neutralization of Special Elements used in a Command ('Command Injection') in @floffah/build. Affects @floffah/build versions < 1.0.0. Fixed in 1.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @floffah/build package is an npm package that provides build tools for JavaScript projects. It is commonly used to compile and bundle JavaScript code. The package is vulnerable to a command injection vulnerability, which allows attackers to inject malicious commands through the esbuild target or command. This can lead to unauthorized changes to project settings and potential damage to the project.
Vulnerability Detail
The command injection vulnerability in @floffah/build arises from improper neutralization of special elements used in a command. Attackers can exploit this vulnerability by manipulating the command line options to inject malicious code or change project configurations. The impact of this vulnerability can range from unauthorized access to sensitive information to complete compromise of the project's integrity. The vulnerability has been assigned a severity level of LOW and is classified under CWE-77.
How To Fix
Latest published version: 1.0.0 as of 22 Oct 2026
npm install @floffah/build@1.0.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the patched version (1.0.0) as soon as possible to protect your project from potential exploitation.
Conclusion
The command injection vulnerability in @floffah/build can have serious consequences for your project's security and integrity. It is crucial to update to version 1.0.0 or later to mitigate the risk of exploitation. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for @floffah/build →
FAQ
The vulnerability allows attackers to inject malicious commands and potentially modify project settings, leading to unauthorized access, data leakage, or project compromise.
You can fix this vulnerability by updating to version 1.0.0 of @floffah/build, which includes a patch that addresses the issue.
No, there is no known workaround for this vulnerability. Updating to the patched version is the recommended solution.
The vulnerability has been assigned a severity level of LOW.
CWE-77 is a Common Weakness Enumeration category that refers to Improper Neutralization of Special Elements used in a Command ('Command Injection'). It is a vulnerability that allows an attacker to execute arbitrary commands on a target system.
