--- title: "CX-2021-4773" date: "2021-01-21T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cx-2021-4773/" --- # CX-2021-4773 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) Fixed: Jan 21, 2021 CVE-2021-26276 **Published:** Jan 21, 2021 5.3 Medium Severity javascript node nodejs npm RCE typescript AZ Adar Zandberg Reported by Checkmarx Zero Details Overview ## Summary When using config-shield in CLI mode, malicious code could be executed when passed through the ‘set’ command. ## Product config-shield before 0.2.3 ## Impact This issue may lead to remote code execution if a server running the library uses the vulnerable command with untrusted input. ## Steps to reproduce ```bash > npm run start - enter path of config (enter to use existing path)> - enter path of private key (press enter to use private key path in config)> : loading...done > set require("child_process").exec("touch HACKED") > exit ``` ### Expected result: A file named `HACKED` has been created. ## Remediation Always sanitize untrusted input. Update to the nonvulnerable [\[email protected\]](https://checkmarx.com/cdn-cgi/l/email-protection). ## Credit This issue was discovered and reported by Checkmarx SCA Security Analyst [Adar Zandberg](https://www.linkedin.com/in/adarz). ## Resources 1. [cdba5d3](https://github.com/godaddy/node-config-shield/commit/cdba5d3a7accd661ffbc52e208153464bd0d9da6) 0 Medium Severity CVSS v3.1 Score 5.3 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None Advisory Timeline1. Discovered Jan 20, 2021 Notified developer 2. Fixed Jan 21, 2021 [\[email protected\]](https://checkmarx.com/cdn-cgi/l/email-protection) was released ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)