The find‑cypress‑specs tool contains a weakness in the shell.exec function in src/index.js that allows the --branch parameter to be manipulated. This leads to an operating‑system command injection that can execute arbitrary commands on the host where the tool is run. The vulnerability maps to vulnerabilities CWE‑77 and CWE‑78 and results in local command execution, potentially giving an attacker control over the executing process.

The vulnerable code is present in the bahmutov find‑cypress‑specs package, specifically in all releases up to and including version 1.54.12. The component is distributed as a Node.js library used for discovering Cypress test files.

The CVSS score of 4.8 indicates a moderate severity, and the EPSS score of less than 1 % shows a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation is limited to local execution; an attacker must have the ability to run the find‑cypress‑specs process or supply a crafted --branch argument. The exploit code is publicly available, but no vendor‑issued patch has yet been released.