Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Eslint-Utils Allows Arbitrary Code Execution

CVE-2019-15657 · published 7 years ago
Summary

A bug in eslint-utils could allow hackers to execute any code they want. This affects users who have eslint-utils installed and used in their development environment. It's recommended to update eslint-utils to version 1.4.1 or later to fix this issue.

What to do
  • Update mysticatea eslint-utils to version 1.4.1.
  • Update eslint-utils_project eslint-utils to version 1.4.1 or later.
Affected software
Ecosystem VendorProductAffected versions
npm mysticatea eslint-utils >= 1.2.0, < 1.4.1
Fix: upgrade to 1.4.1
– eslint-utils_project eslint-utils < 1.4.1
cpe:2.3:a:eslint-utils_project:eslint-utils:*:*:*:*:*:node.js:*:*
Original advisory text
In eslint-utils before 1.4.1, the getStaticValue function can execute arbitrary code.
In eslint-utils before 1.4.1, the getStaticValue function can execute arbitrary code.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published26 Aug 2019
Updated29 Oct 2026
First seen6 Mar 2026
Sources
GHSA-3gx7-xhv7-5mx3 · GHSA
CVE-2019-15657 · NVD
Track software like this
Free during beta