Description

In eslint-utils before 1.4.1, the getStaticValue function can execute arbitrary code.

Remediation

References

https://github.com/mysticatea/eslint-utils/security/advisories/GHSA-3gx7-xhv7-5mx3

Related Vulnerabilities

CVE-2021-39157 Vulnerability in npm package detect-character-encoding

CVE-2020-2217 Vulnerability in maven package org.jenkins-ci.plugins:compatibility-action-storage

CVE-2023-3224 Vulnerability in npm package nuxt

CVE-2022-39263 Vulnerability in npm package next-auth

CVE-2022-25906 Vulnerability in npm package is-http2

Severity

Critical

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory NVD-CWE-noinfo