Description

The eslint-fixer package through 0.1.5 for Node.js allows command injection via shell metacharacters to the fix function. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. The ozum/eslint-fixer GitHub repository has been intentionally deleted

Remediation

References

https://www.npmjs.com/package/eslint-fixer

https://advisory.checkmarx.net/advisory/CX-2021-4774

Related Vulnerabilities

CVE-2022-35143 Vulnerability in npm package raneto

CVE-2019-16728 Vulnerability in maven package org.webjars.bowergithub.cure53:dompurify

CVE-2020-7715 Vulnerability in npm package deep-get-set

CVE-2022-0654 Vulnerability in npm package requestretry

CVE-2018-16487 Vulnerability in npm package lodash.merge

Severity

Critical

Classification

CWE-77 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Product Exploit Third Party Advisory