CVE-2020-7626: 
JavaScript vulnerability analysis and mitigation

karma-mojo is a plugin for Karma that provides functionality for running a select subset of tests instead of the entire test suite. A command injection vulnerability (CVE-2020-7626) was discovered in all versions of karma-mojo. The vulnerability was disclosed on April 2, 2020, and affects all versions of the package (Snyk).

The vulnerability exists because the config argument can be controlled by users without any sanitization, allowing for command injection. The issue has a CVSS v3.1 base score of 7.5, indicating medium severity. The vulnerability is exploitable remotely and requires no special privileges or user interaction (CISA, Snyk).

A successful exploitation of this vulnerability could lead to arbitrary command execution on the affected system. An attacker could inject malicious commands through the config argument, potentially compromising the security of the system running the karma-mojo plugin (Snyk).

There is no fixed version available for karma-mojo. Users are advised to assess their usage of this package and consider alternative solutions or implementing additional security controls to prevent command injection attacks (Snyk).