Executive brief
A security vulnerability exists in check-peer-dependencies, a tool used by developers to manage and verify software package requirements in NodeJS projects. If a developer runs this tool within a project containing a maliciously crafted configuration file, an attacker could execute arbitrary commands on the developer's computer. This could lead to the theft of sensitive data, installation of malware, or full system compromise.
Technical details
A command injection vulnerability exists in check-peer-dependencies up to version 4.3.4 due to the unsafe use of the shelljs.exec() function. The tool extracts package names from the peerDependencies section of a package.json file and interpolates them directly into shell command strings (e.g., 'npm view <package> versions' or 'npm install <package>') without proper sanitization. An attacker can exploit this by providing a malicious package name containing shell metacharacters (such as semicolons or backticks). When a user runs the tool with flags like --findSolutions or --install in a directory containing the malicious configuration, the injected commands are executed with the privileges of the user running the tool. As of the advisory date, no official patch has been released.
Affected products
- christopherthielen check-peer-dependencies up to 4.3.4
Timeline
- 2026-06-07: disclosed: Issue reported to the project maintainer via GitHub issue #74
- 2026-07-08: advisory: CVE-2026-15033 published by NVD/VulDB