CVE-2025-57285: codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function (lib/utils.js). The execSync command directly concatenates the…

PriorityP270critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

2.17%

80.0th percentile

codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function (lib/utils.js). The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
codecept	codeceptjs	—	—
codecept	codeceptjs	>= 3.5.0 < 3.7.5	3.7.5

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.