github_osv/GHSA-c9j3-wqph-5xx9
Command Injection in egg-scripts
Versions of `egg-scripts` before 2.8.1 are vulnerable to command injection. This is only exploitable if a malicious argument is provided on the command line.
Example:
`eggctl start --daemon --stderr='/tmp/eggctl_stderr.log; touch /tmp/malicious'`
## Recommendation
Update to version 2.8.1 or later.
gitlab/npm/egg-scripts/CVE-2018-3786
OS Command Injection
A command injection vulnerability in egg-scripts allows arbitrary shell command execution through a maliciously crafted command line argument.