PT-2026-56413 · Christopherthielen · Check-Peer-Dependencies

Dremig · Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-15033

NVD

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

A flaw has been found in christopherthielen check-peer-dependencies up to 4.3.4. Affected by this vulnerability is the function shelljs.exec of the file dist/packageUtils.js of the component peerDependencies. This manipulation causes os command injection. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2026-15033

Affected Products

Check-Peer-Dependencies

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-15033 · Security Note
• https://vuldb.com/cve/CVE-2026-15033 · Note
• https://vuldb.com/vuln/376784/cti · Note
• https://github.com/christopherthielen/check-peer-dependencies · Note
• https://vuldb.com/submit/850875 · Note
• https://vuldb.com/vuln/376784 · Note
• https://github.com/christopherthielen/check-peer-dependencies/issues/74 · Note