CVE-2015-7982: 
JavaScript vulnerability analysis and mitigation

The CVE-2015-7982 is a command injection vulnerability affecting the gm (GraphicsMagick) npm package versions prior to 1.21.1. The vulnerability was discovered in the gm.compare() function, which failed to properly sanitize user input before calling the graphics magic binary (GitHub Advisory).

The vulnerability exists in the gm.compare() function where arguments weren't being escaped properly before being passed to the GraphicsMagick binary. This security issue was fixed by replacing the child_process.exec implementation with child_process.spawn and properly handling command arguments to prevent command injection (GitHub Commit).

Successful exploitation of this vulnerability could lead to arbitrary code execution in the context of the application running the gm package. This is particularly dangerous in web applications that process user-supplied images using the gm.compare() function (GitHub Advisory).

The vulnerability is triggered when user input is passed into gm.compare() without proper sanitization. An attacker could exploit this by providing specially crafted input to the compare function, potentially leading to command injection (GitHub Advisory).

Users should update to gm version 1.21.1 or later, which contains the security fix. The fix was implemented by changing the command execution method and properly handling command arguments to prevent injection attacks (GitHub Advisory).