Key Information Summary Vulnerability Overview Vulnerability Type: Argument Injection in Bun's $ shell API Description: Attackers can bypass Bun's output encoding logic through specific injection attacks (argument injection), enabling execution of malicious commands. Example Usage Example Code: Explanation: If contains shell metacharacters such as , it leads to command injection. Proof of Concept Example Code: Explanation: User input is interpreted as command-line arguments, resulting in successful execution of the command, creating a file named . Impact Impact: Ignoring in user input may alter command behavior. Analysis Recommendation: Bun should implement additional security controls to prevent user input from being interpreted as command-line arguments. Environment Tested Version: Bun 1.1.38 CVE Details Affected Product: bun <=1.1.39 CWE ID: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')