GHSA-rphm-c8gw-3r38

OS Command Injection in lifion-verify-deps

Source: GitHub Advisory Database (reviewed) High CVE-2021-34078

Packages

Ecosystem	Package	Affected	Fixed in
npm	lifion-verify-deps	< 1.2.0	1.2.0

Details

As written in the advisory (Markdown source, shown as plain text).

lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's package.json file.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-34078 advisory
https://github.com/lifion/lifion-verify-deps/commit/be1133d5b78e3caa0004fa60207013dca4e1bf38 web
https://advisory.checkmarx.net/advisory/CX-2021-4785 web
https://github.com/lifion/lifion-verify-deps package