EUVD-2026-47862
GHSA-8vqr-xp4f-pr6m
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack via npm script execution requiring low-privilege access; no scope change; limited impact across all three pillars consistent with CVSS 4.0 source data.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security vulnerability has been detected in syncfusion ej2-javascript-ui-controls up to 33.2.3. This affects the function child_process.exec of the file package.json. The manipulation leads to os command injection. An attack has to be approached locally. The exploit has been disclosed publicly and may be used.
AnalysisAI
OS command injection in Syncfusion ej2-javascript-ui-controls through version 33.2.3 allows a local attacker with low-privilege access to execute arbitrary operating system commands via unsanitized input passed to the child_process.exec function referenced in package.json. This is a build-time or script-execution sink, meaning exploitation is most likely during npm script invocation in developer workstations or CI/CD pipelines rather than in end-user browsers. A public proof-of-concept exists (GitHub issue #215); no CISA KEV listing is present, and the CVSS 4.0 score of 4.8 reflects limited real-world impact constrained to the local system.
Technical ContextAI
The affected component is the Syncfusion ej2-javascript-ui-controls JavaScript UI library (CPE: cpe:2.3:a:syncfusion:ej2-javascript-ui-controls:*:*:*:*:*:*:*:*), a commercial, enterprise-grade set of UI components for Angular, React, Vue, and vanilla JavaScript. The vulnerability maps to CWE-78 (Improper Neutralization of Special Elements used in an OS Command), a classic command injection root cause where user-controlled or externally-influenced data is concatenated into a shell command string without sanitization. The specific sink is child_process.exec, Node.js's function for spawning a shell and executing commands - a high-risk API when used with unsanitized input because it passes the argument through /bin/sh (or cmd.exe on Windows), enabling shell metacharacter abuse. Its presence in package.json suggests this is invoked via an npm lifecycle script (e.g., preinstall, postinstall, build), making the attack surface the development and CI/CD toolchain rather than browser-side runtime.
RemediationAI
No vendor-released patch version has been independently confirmed from the available data - the fix status should be verified directly at https://github.com/syncfusion/ej2-javascript-ui-controls and https://vuldb.com/vuln/382380 for updated advisories. As an immediate compensating control, audit all npm lifecycle scripts (preinstall, postinstall, prepare, build) in the ej2-javascript-ui-controls package and any wrappers that invoke child_process.exec with externally influenced input; replace with child_process.execFile or spawn with argument arrays, which do not invoke a shell and are immune to shell metacharacter injection - the trade-off is minor API refactoring. In CI/CD environments, run npm install and build steps in minimal-privilege sandboxed containers to contain the blast radius if exploitation occurs; restricting write access to the working directory limits what injected commands can modify. Monitor the GitHub issue (https://github.com/syncfusion/ej2-javascript-ui-controls/issues/215) for a patched release and upgrade immediately when one is available.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today