Summary
The eslint-fixer Node.js package is vulnerable to command injection. Exploitation is possible via unsanitized shell metacharacters provided to the fix() function.
Product
All versions of the eslint-fixer NPM package.
Impact
This issue may lead to remote code execution on a machine running the eslint-fixer.
Steps to reproduce
const fix = require("eslint-fixer");
fix("; touch HACKED; ")Expected result:
A file named HACKED has been created.
Remediation
The package is deprecated. It is recommended to use a different package since this one is not properly maintained.
It is recommended to sanitize every untrusted input used by your applications.
Credit
This issue was discovered and reported by Checkmarx SCA Security Analyst Adar Zandberg.
