| शीर्षक | Node.js check-peer-dependencies 4.3.4 OS Command Injection |
|---|
| विवरण | [email protected] is vulnerable to OS command injection when processing package names from peerDependencies.
The package reads dependency names from package.json and later interpolates those names into shell command strings. When --findSolutions is enabled, a malicious dependency name is passed into an npm view <package> versions command. Because the command is executed through shelljs.exec(), shell metacharacters in the dependency name are interpreted by the operating system shell.
The same data flow can also affect installation flows: generated npm install / yarn add command strings are later executed through shelljs.exec() when --install is used.
The PoC was verified against the current npm latest version 4.3.4. |
|---|
| स्रोत | ⚠️ https://github.com/christopherthielen/check-peer-dependencies/issues/74 |
|---|
| उपयोगकर्ता | Dremig (UID 95003) |
|---|
| सबमिशन | 07/06/2026 08:41 AM (1 महीना पहले) |
|---|
| संयम | 08/07/2026 09:36 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 376784 [christopherthielen check-peer-dependencies तक 4.3.4 peerDependencies dist/packageUtils.js shelljs.exec अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|