CVE-2021-26275: Improper Neutralization of Special Elements used in a Command ('Command Injection')

April 13, 2021

** UNSUPPORTED WHEN ASSIGNED ** The eslint-fixer package for Node.js allows command injection via shell metacharacters to the fix function. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. The ozum/eslint-fixer GitHub repository has been intentionally deleted.

References

advisory.checkmarx.net/advisory/CX-2021-4774
github.com/advisories/GHSA-45w5-pvr8-4rh5
nvd.nist.gov/vuln/detail/CVE-2021-26275
www.npmjs.com/package/eslint-fixer

Code Behaviors & Features

Detect and mitigate CVE-2021-26275 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →