OS Command Injection in execa (execa@^1.0.0)

[furqanbaqai]

dependency execa@^1.0.0 has the following vulnerability reported:

Description:
Attackers could trick execa into executing arbitrary binaries. This behaviour is caused by the setting preferLocal=true which makes execa search for locally installed binaries and executes them.

Idenfiers
Gemnasium-05cfa2e8-2d0c-42c1-8894-638e2f12ff3d

Severity
Critical

[kelvinlouis]

Is a patch planned? This vulnerability prohibits us from publishing or package.

[chrised123]

@amasad can you please approve this merge?

[amasad]

Hey guys, I'm not really coding anymore so can't really test and maintain this package. Anyone wants to be a maintainer? cc @stefanpenner if he has any ideas.

[COScholl]

sane@4.1.0 is now deprecated in favor of sane@5.0.1 using execa@4.0.0