Executive brief
eslint-fixer is a Node.js package used to automatically fix ESLint code style violations. The package contains a command injection vulnerability that allows attackers to execute arbitrary shell commands through specially crafted input to the fix function. Since the package is no longer maintained and the repository has been deleted, no patch is available for users.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the fix function of eslint-fixer, where shell metacharacters in user-supplied input are not properly sanitized before being passed to shell execution. This allows an attacker to inject arbitrary commands. The attack vector is network-accessible if the vulnerable code is exposed through a web service, requires no authentication or user interaction, and can result in arbitrary command execution with the privileges of the Node.js process. There is no patch available, as the maintainer has intentionally deleted the GitHub repository and no longer supports the project.
Affected products
- npm eslint-fixer 0.1.5 and all previous versions
Timeline
- 2021-03-19: disclosed: NVD published
- 2021-04-13: advisory: GHSA advisory published