GHSA-8mgg-5x65-m4m4: 
JavaScript vulnerability analysis and mitigation

A high-severity command injection vulnerability was identified in the soletta-dev-app npm package (GHSA-8mgg-5x65-m4m4). The vulnerability was discovered and reviewed on August 31, 2020, published to the GitHub Advisory Database on September 11, 2020, and last updated on January 9, 2023. This security issue affects all versions of the soletta-dev-app package (GitHub Advisory).

The vulnerability is classified as a Command Injection (CWE-77) with high severity. The security flaw exists in the /api/service/status API endpoint, where the package fails to properly validate user input. Specifically, the contents of the service query parameter are passed directly to an exec call without proper sanitization (GitHub Advisory).

This vulnerability allows attackers to execute arbitrary commands on the affected system through the unsanitized service query parameter, potentially leading to complete system compromise (GitHub Advisory).

The vulnerability affects all versions of the package (>= 0), and due to its nature of allowing direct command execution through an API endpoint, it presents a significant security risk. No specific instances of exploitation in the wild have been publicly reported (GitHub Advisory).

Currently, no fix is available for this vulnerability. The recommended mitigation strategy is to use an alternative module until a security fix is released (GitHub Advisory).