Arbitrary Code Execution Affecting eslint-utils package, versions >=1.2.0 <1.4.1


0.0
high
0
10

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    EPSS 0.36% (73rd percentile)
Expand this section
NVD
9.8 critical

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-ESLINTUTILS-460220
  • published 23 Aug 2019
  • disclosed 20 Aug 2019
  • credit Toru Nagashima

How to fix?

Upgrade eslint-utils to version 1.4.1 or higher.

Overview

eslint-utils is a package provides utility functions and classes for make ESLint custom rules.

Affected versions of this package are vulnerable to Arbitrary Code Execution. The getStaticValue does not properly sanitize user input allowing attackers to supply malicious input that executes arbitrary code during the linting process. The getStringIfConstant and getPropertyName functions are not affected.