CVE-2019-15657 - In eslint-utils before 1.4.1, the getStaticValue function can execute arbitrary code

CRITICAL

In eslint-utils before 1.4.1, the getStaticValue function can execute arbitrary code

Published Aug 26, 2019

9.8

CRITICAL

CVSS 3.0

EPSS 2.27%

In eslint-utils before 1.4.1, the getStaticValue function can execute arbitrary code.

Ecosystem	Package	Introduced	Fixed
npm	eslint-utils	1.2.0	1.4.1

No remediation recorded yet.

Weaknesses (1)

CWE-20

Improper Input Validation

Link	Providers	Tags
https://eslint.org/blog/2019/08/eslint-v6.2.1-released
https://github.com/advisories/GHSA-3gx7-xhv7-5mx3		Advisory
https://github.com/mysticatea/eslint-utils/commit/08158db1c98fd71cf0f32ddefbc147e2620e724c
https://github.com/mysticatea/eslint-utils/security/advisories/GHSA-3gx7-xhv7-5mx3		x_refsource_MISCThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-15657
https://www.npmjs.com/advisories/1118