AIKIDO-2026-10105

TL;DR

Affected versions of this package are vulnerable to Arbitrary Code Execution via a command injection vulnerability in the APNS certificate P12 decoder, where a maliciously crafted P12 filename could be executed as shell code due to unsafe passing of user-provided strings to execSync. The fix replaced execSync with spawnSync to ensure strings are always treated as parameters, not executable code, and added validation to confirm the PEM file exists before access. An attacker could exploit this by providing a specially crafted filename containing shell metacharacters or commands, which would be executed in the context of the application's process when the decoder was invoked.