Arbitrary Code Execution Affecting eslint-utils package, versions >=1.2.0 <1.4.1
Snyk CVSS
Attack Complexity
Low
Threat Intelligence
EPSS
0.36% (72nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-ESLINTUTILS-460220
- published 23 Aug 2019
- disclosed 20 Aug 2019
- credit Toru Nagashima
Introduced: 20 Aug 2019
CVE-2019-15657 Open this link in a new tabHow to fix?
Upgrade eslint-utils to version 1.4.1 or higher.
Overview
eslint-utils is a package provides utility functions and classes for make ESLint custom rules.
Affected versions of this package are vulnerable to Arbitrary Code Execution. The getStaticValue does not properly sanitize user input allowing attackers to supply malicious input that executes arbitrary code during the linting process. The getStringIfConstant and getPropertyName functions are not affected.