Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNneDcteGh2Ny01bXgz

Arbitrary Code Execution in eslint-utils

Versions of eslint-utils >=1.2.0 or <1.4.1 are vulnerable to Arbitrary Code Execution. The getStaticValue does not properly sanitize user input allowing attackers to supply malicious input that executes arbitrary code during the linting process. The getStringIfConstant and getPropertyName functions are not affected.

Recommendation

Upgrade to version 1.4.1 or later.

Permalink: https://github.com/advisories/GHSA-3gx7-xhv7-5mx3
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNneDcteGh2Ny01bXgz
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 4 years ago
Updated: 6 months ago

CVSS Score: 9.8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-3gx7-xhv7-5mx3, CVE-2019-15657
References:

• https://github.com/mysticatea/eslint-utils/security/advisories/GHSA-3gx7-xhv7-5mx3
• https://nvd.nist.gov/vuln/detail/CVE-2019-15657
• https://eslint.org/blog/2019/08/eslint-v6.2.1-released
• https://github.com/advisories/GHSA-3gx7-xhv7-5mx3
• https://www.npmjs.com/advisories/1118
• https://github.com/mysticatea/eslint-utils/commit/08158db1c98fd71cf0f32ddefbc147e2620e724c

Repository: https://github.com/mysticatea/eslint-utils
Blast Radius: 62.9

Affected Packages