Deserialization of Untrusted Data
The RunProcess class can be leveraged as a gadget to run arbitrary commands on a system that is deserializing user input without validation.
Advisories for Composer/Codeception/Codeception package
2021
The RunProcess class can be leveraged as a gadget to run arbitrary commands on a system that is deserializing user input without validation.