EUVD-2026-42234
GHSA-fmmh-7qjr-fp9g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
OS command injection grants arbitrary code execution, warranting C:H/I:H/A:H; PR:L because attacker must control peerDependency input data fed to the tool.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A flaw has been found in christopherthielen check-peer-dependencies up to 4.3.4. Affected by this vulnerability is the function shelljs.exec of the file dist/packageUtils.js of the component peerDependencies. This manipulation causes os command injection. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
OS command injection in christopherthielen/check-peer-dependencies up to version 4.3.4 allows remote low-privileged attackers to execute arbitrary operating system commands via the shelljs.exec() call in dist/packageUtils.js when processing peerDependency data. The vulnerable code path passes unsanitized dependency-related input directly to a shell execution function, a classic CWE-78 pattern. No vendor patch is available at time of analysis - the project maintainer has not responded to the issue report filed on GitHub (issue #74), and no KEV listing exists. EPSS data was not provided, so broad exploitation probability cannot be quantified.
Technical ContextAI
check-peer-dependencies is an npm CLI utility authored by christopherthielen, used by developers and CI/CD pipelines to validate that installed packages satisfy peer dependency requirements declared in package.json. The vulnerability resides in dist/packageUtils.js, where the function uses shelljs.exec() - a Node.js shell execution wrapper - to run system commands as part of dependency resolution logic. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) arises when attacker-influenced strings, such as package names or version specifiers sourced from peerDependency declarations in a malicious or compromised package.json, are interpolated into shell command strings without escaping shell metacharacters. The affected CPE is cpe:2.3:a:christopherthielen:check-peer-dependencies:*:*:*:*:*:*:*:*, covering all versions through 4.3.4.
RemediationAI
No vendor-released patch has been identified at time of analysis - the upstream maintainer has not responded to the vulnerability disclosure. Organizations using check-peer-dependencies should immediately audit all CI/CD pipelines and developer toolchains for its presence. As a primary compensating control, remove or replace check-peer-dependencies with an alternative peer dependency validation tool that does not rely on shell exec wrappers; note that switching tools may require pipeline script changes and validation of equivalent functionality. If removal is not immediately feasible, restrict the tool's execution environment to read-only containers with no internet access and no sensitive credentials mounted, limiting the blast radius of a successful injection. Additionally, enforce strict package.json content validation and lock dependency manifests (package-lock.json or yarn.lock) so that peerDependency fields cannot be tampered with by untrusted third-party packages. Monitor the GitHub issue at https://github.com/christopherthielen/check-peer-dependencies/issues/74 and the VulDB entry at https://vuldb.com/cve/CVE-2026-15033 for patch availability.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today