CVE-2026-15033
MediumCVSS 6.3Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
A vulnerability has been found in check-peer-dependencies up to version 4.3.4, allowing OS command injection via the shelljs.exec function in dist/packageUtils.js within the peerDependencies component. The attack can be initiated remotely.
Risk Assessment
The organization is at risk of remote arbitrary command execution, potentially leading to server compromise or data exfiltration.
Recommendation
Immediately update check-peer-dependencies to a version newer than 4.3.4 if available, or apply temporary mitigations restricting access to the shelljs.exec function.
Original NVD description (English source)
A flaw has been found in christopherthielen check-peer-dependencies up to 4.3.4. Affected by this vulnerability is the function shelljs.exec of the file dist/packageUtils.js of the component peerDependencies. This manipulation causes os command injection. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.