PT-2019-14325 · Eslint · Eslint-Utils

Mysticatea · Published 2019-08-26 · Updated 2020-08-24 · CVE-2019-15657

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eslint-utils versions 1.2.0 through 1.4.0

Description The issue concerns the execution of arbitrary code due to improper sanitization of user input by the getStaticValue function. This allows attackers to supply malicious input that executes arbitrary code during the linting process. The getStringIfConstant and getPropertyName functions are not affected.

Recommendations Upgrade to version 1.4.1 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2019-15657

GHSA-3GX7-XHV7-5MX3

Affected Products

Eslint-Utils

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2019-15657 · Security Note
• https://osv.dev/vulnerability/GHSA-3gx7-xhv7-5mx3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15657 · Vendor Advisory
• https://github.com/mysticatea/eslint-utils/security/advisories/GHSA-3gx7-xhv7-5mx3 · Note
• https://github.com/mysticatea/eslint-utils · Note
• https://github.com/mysticatea/eslint-utils/commit/08158db1c98fd71cf0f32ddefbc147e2620e724c · Note
• https://npmjs.com/advisories/1118 · Note
• https://github.com/advisories/GHSA-3gx7-xhv7-5mx3 · Note
• https://eslint.org/blog/2019/08/eslint-v6.2.1-released · Note