CVE-2026-15033

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15033", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-07-08T07:36:46.092Z", "datePublished": "2026-07-08T13:15:07.664Z", "dateUpdated": "2026-07-08T17:08:58.946Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-08T13:15:07.664Z"}, "title": "christopherthielen check-peer-dependencies peerDependencies packageUtils.js shelljs.exec os command injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-78", "lang": "en", "description": "OS Command Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "Command Injection"}]}], "affected": [{"vendor": "christopherthielen", "product": "check-peer-dependencies", "versions": [{"version": "4.3.0", "status": "affected"}, {"version": "4.3.1", "status": "affected"}, {"version": "4.3.2", "status": "affected"}, {"version": "4.3.3", "status": "affected"}, {"version": "4.3.4", "status": "affected"}], "cpes": ["cpe:2.3:a:christopherthielen:check-peer-dependencies:*:*:*:*:*:*:*:*"], "modules": ["peerDependencies"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in christopherthielen check-peer-dependencies up to 4.3.4. Affected by this vulnerability is the function shelljs.exec of the file dist/packageUtils.js of the component peerDependencies. This manipulation causes os command injection. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-07-08T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-07-08T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-07-08T09:41:51.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Dremig (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/376784", "name": "VDB-376784 | christopherthielen check-peer-dependencies peerDependencies packageUtils.js shelljs.exec os command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/376784/cti", "name": "VDB-376784 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-15033", "name": "CVE-2026-15033 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/850875", "name": "Submit #850875 | Node.js check-peer-dependencies 4.3.4 OS Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/christopherthielen/check-peer-dependencies/issues/74", "tags": ["issue-tracking"]}, {"url": "https://github.com/christopherthielen/check-peer-dependencies/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-08T14:15:23.390150Z", "id": "CVE-2026-15033", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-08T17:08:58.946Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-15033", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-08T14:15:23.390150Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-08T14:15:45.690Z"}}], "cna": {"title": "christopherthielen check-peer-dependencies peerDependencies packageUtils.js shelljs.exec os command injection", "credits": [{"lang": "en", "type": "reporter", "value": "Dremig (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:christopherthielen:check-peer-dependencies:*:*:*:*:*:*:*:*"], "vendor": "christopherthielen", "modules": ["peerDependencies"], "product": "check-peer-dependencies", "versions": [{"status": "affected", "version": "4.3.0"}, {"status": "affected", "version": "4.3.1"}, {"status": "affected", "version": "4.3.2"}, {"status": "affected", "version": "4.3.3"}, {"status": "affected", "version": "4.3.4"}]}], "timeline": [{"lang": "en", "time": "2026-07-08T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-07-08T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-07-08T09:41:51.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/376784", "name": "VDB-376784 | christopherthielen check-peer-dependencies peerDependencies packageUtils.js shelljs.exec os command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/376784/cti", "name": "VDB-376784 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-15033", "name": "CVE-2026-15033 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/850875", "name": "Submit #850875 | Node.js check-peer-dependencies 4.3.4 OS Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/christopherthielen/check-peer-dependencies/issues/74", "tags": ["issue-tracking"]}, {"url": "https://github.com/christopherthielen/check-peer-dependencies/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in christopherthielen check-peer-dependencies up to 4.3.4. Affected by this vulnerability is the function shelljs.exec of the file dist/packageUtils.js of the component peerDependencies. This manipulation causes os command injection. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "OS Command Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "Command Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-08T13:15:07.664Z"}}}, "cveMetadata": {"cveId": "CVE-2026-15033", "state": "PUBLISHED", "dateUpdated": "2026-07-08T17:08:58.946Z", "dateReserved": "2026-07-08T07:36:46.092Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-07-08T13:15:07.664Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:christopherthielen:check-peer-dependencies:*:*:*:*:*:*:*:*"], "modules": ["peerDependencies"], "product": "check-peer-dependencies", "vendor": "christopherthielen", "versions": [{"status": "affected", "version": "4.3.0"}, {"status": "affected", "version": "4.3.1"}, {"status": "affected", "version": "4.3.2"}, {"status": "affected", "version": "4.3.3"}, {"status": "affected", "version": "4.3.4"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw has been found in christopherthielen check-peer-dependencies up to 4.3.4. Affected by this vulnerability is the function shelljs.exec of the file dist/packageUtils.js of the component peerDependencies. This manipulation causes os command injection. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se ha encontrado una falla en christopherthielen check-peer-dependencies hasta la versi\u00f3n 4.3.4. Afectada por esta vulnerabilidad es la funci\u00f3n shelljs.exec del archivo dist/packageUtils.js del componente peerDependencies. Esta manipulaci\u00f3n causa inyecci\u00f3n de comandos del sistema operativo. El ataque puede ser iniciado remotamente. El proyecto fue informado del problema tempranamente a trav\u00e9s de un informe de incidencias, pero a\u00fan no ha respondido."}], "id": "CVE-2026-15033", "lastModified": "2026-10-25T20:10:00.147", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15033", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-08T14:15:23.390150Z", "version": "2.0.3"}}]}, "published": "2026-07-08T14:16:56.273", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/christopherthielen/check-peer-dependencies/"}, {"source": "cna@vuldb.com", "url": "https://github.com/christopherthielen/check-peer-dependencies/issues/74"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-15033"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/850875"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/376784"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/376784/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}, {"lang": "en", "value": "CWE-78"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.3.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.3.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.3.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.3.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.3.4"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "check-peer-dependencies", "source": "cna", "vendor": "christopherthielen"}, "product": "check-peer-dependencies", "vendor": "christopherthielen"}], "created": "2026-07-09T10:15:04.697388+00:00", "title": "check\u2011peer\u2011dependencies Vulnerability Allows OS Command Injection", "updated": "2026-08-01T16:30:04.604553+00:00", "vendors": ["christopherthielen", "christopherthielen$PRODUCT$check-peer-dependencies"]}