Junglewise Threat Intelligence

CVE-2019-15657: mysticatea eslint-utils arbitrary code execution in getStaticValue

CVE-2019-15657 · Severity: low · CVSS 3 · Published 2019-08-26

Vendors: npm.

Executive brief

A vulnerability in a common JavaScript utility library could allow attackers to execute malicious code on systems that analyze untrusted source code. This is particularly risky for web-based development tools or automated build servers that process code from external users. An exploit could lead to a full system compromise, data theft, or unauthorized access to development environments.

Technical details

A vulnerability exists in the 'getStaticValue' function of eslint-utils due to improper input validation (CWE-20). When the library attempts to evaluate static values in JavaScript source code, it fails to properly sanitize the input, allowing an attacker to craft malicious source text that executes arbitrary JavaScript code during the linting process. This is a network-reachable attack vector for any service that lints user-provided code (e.g., Linting-as-a-Service). The issue was addressed in version 1.4.1 by improving the sanitization of built-in objects and global variables.

Affected products

  • mysticatea eslint-utils >= 1.2.0, < 1.4.1

Timeline

  • 2019-08-20: patched: Version 1.4.1 released to address the vulnerability.
  • 2019-08-20: advisory: ESLint and mysticatea published security advisories.
  • 2019-08-26: disclosed: Public disclosure and CVE assignment.

References