gitlab/npm/sync-exec/CVE-2017-16024
Information Exposure
The sync-exec module is used to simulate `child_process` Sync-exec uses `tmp` directories as a buffer before returning values. Other users on the server have read access to the `tmp` directory, possibly allowing an attacker on the server to obtain confidential information from the `buffer/tmp` file, while it exists.