Vulnerability in transitive execa dependency

[gitLinda]

Hi,

We are using the @swc/cli which brings in a very old version of execa from transitive dependencies. This execa version contains a "Uncontrolled Search Path Element" vulnerability.

bin-check seems to be not maintained anymore, but there is a fork of available: see this issue.
Unfortunately @mole-inc/bin-wrapper seems unmaintained as well.

A fix would be very appreciated.

[rrushextern]

Hi there,

We're facing the same issue with the package. Any updates on this?

[kdy1]

This issue cannot be exploited considering the code of @swc/cli

[gitLinda]

Hi @kdy1 it would still be nice to fix it since it shows up all the time in security reports

[kdy1]

I'll happily accept a PR