Command injection in eslint-fixer

CRITICAL 9.8CVE-2021-26275 · GHSA-45w5-pvr8-4rh5 · Published 19/03/2021 · updated 17/06/2026

In short

CVE-2021-26275 is a CRITICAL (CVSS 9.8) vulnerability affecting eslint-fixer (eslint-fixer project), eslint-fixer.
Chance of exploitation in the next 30 days (EPSS): 3.0%, higher than 87.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
eslint-fixer eslint-fixer_project	`≤ 0.1.5`	No fix yet
eslint-fixer npm	`≤ 0.1.5`	No fix yet

Description

The eslint-fixer package through 0.1.5 for Node.js allows command injection via shell metacharacters to the fix function. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. The ozum/eslint-fixer GitHub repository has been intentionally deleted.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2021-26275 · ADVISORY
advisory.checkmarx.net/advisory/CX-2021-4774 · WEB
npmjs.com/package/eslint-fixer · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free