AIKIDO-2026-919131
tinyexec is vulnerable to Untrusted Search Path
30
Low Risk
This Affects:
tinyexecTL;DR
tinyexec's main.ts passes every command through normaliseCommandAndArgs, which calls path.normalize on the command string before parsing and spawning it. path.normalize strips a leading ./ (for example ./mytool becomes mytool), so an explicit local path turns into a bare program name that Node searches for on PATH instead. This lets a program earlier on PATH run in place of the intended local executable. The fix removes the normalization step and spawns using the original command and args unchanged.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you pass a command that starts with ./ to x, xSync, or pipe, expecting it to run the file at that relative path instead of being resolved through PATH.
Background info
tinyexec is vulnerable to Untrusted Search Path in versions 0.0.1 - 1.1.1.
How to fix this
Upgrade the tinyexec library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.