fs-path node module before 0.0.25 is vulnerable to command injection by way of user-supplied inputs via the `copy`, `copySync`, `remove`, and `removeSync` methods.
CVSS 3.1CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.11168·Published 2021-03-04·Fixed in 0.0.25CWE-77