GHSA-3gx7-xhv7-5mx3

Arbitrary Code Execution in eslint-utils

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-15657

Packages

Ecosystem	Package	Affected	Fixed in
npm	eslint-utils	>= 1.2.0, < 1.4.1	1.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `eslint-utils` >=1.2.0 or <1.4.1 are vulnerable to Arbitrary Code Execution. The `getStaticValue` does not properly sanitize user input allowing attackers to supply malicious input that executes arbitrary code during the linting process. The `getStringIfConstant` and `getPropertyName` functions are not affected. ## Recommendation Upgrade to version 1.4.1 or later.

References

External links from the advisory. They lead to third-party sites.

https://github.com/mysticatea/eslint-utils/security/advisories/GHSA-3gx7-xhv7-5mx3 web
https://nvd.nist.gov/vuln/detail/CVE-2019-15657 advisory
https://github.com/mysticatea/eslint-utils/commit/08158db1c98fd71cf0f32ddefbc147e2620e724c web
https://eslint.org/blog/2019/08/eslint-v6.2.1-released web
https://github.com/advisories/GHSA-3gx7-xhv7-5mx3 advisory
https://github.com/mysticatea/eslint-utils package
https://www.npmjs.com/advisories/1118 web