Versions of opencvprior to 6.1.0 are vulnerable to Command Injection. The utils/ script find-opencv.js does not validate user input allowing attackers to execute arbitrary commands.

Recommendation

Upgrade to version 6.1.0.

References

• peterbraden/node-opencv@81a4b86#diff-dab2f6d17b2fd005a9425e97172dc8cb
• https://www.npmjs.com/advisories/789