Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in commander

Summary

A local code/OS command execution vulnerability was discovered in Commander.js, in the “parse()” method. Given a permission to write and set permissions on a file in the same working directory as the application, and given the ability to pass the value “__proto__” to the “parse()” method, an attacker can bypass checks against values set in _execs[] to execute an external file which was not intended.