Advisory Weakness Curation

Tmp files readable by other users in sync-exec Affected versions of `sync-exec` use files located in `/tmp/` to buffer command results before returning values. As `/tmp/` is almost always set with world readable permissions, this may allow low privilege users on the system to read the results of commands run via `sync-exec` under a higher privilege user. ## Recommendation There is currently no direct patch for `sync-exec`, as the `child_process.execSync` function provided in Node.js v0.12.0 and later provides the same functionality natively. The best mitigation currently is to update to Node.js v0.12.0 or later, and migrate all uses of `sync-exec` to `child_process.execSync()`.

Information Exposure The sync-exec module is used to simulate `child_process` Sync-exec uses `tmp` directories as a buffer before returning values. Other users on the server have read access to the `tmp` directory, possibly allowing an attacker on the server to obtain confidential information from the `buffer/tmp` file, while it exists.