OS Command Injection in lifion-verify-deps

HIGH 8.8CVE-2021-34078 · GHSA-rphm-c8gw-3r38 · Published 02/06/2022 · updated 17/06/2026

In short

CVE-2021-34078 is a HIGH (CVSS 8.8) vulnerability affecting lifion-verifiy-dependencies (adp), lifion-verify-deps.
Chance of exploitation in the next 30 days (EPSS): 2.4%, higher than 84.2% of all vulnerabilities.
Fix: update to 1.2.0 or later.

Package	Affected versions	Patched versions
lifion-verifiy-dependencies adp	`< 1.2.0`	`1.2.0`
lifion-verify-deps npm	`< 1.2.0`	`1.2.0`

Description

lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's package.json file.

NVD description

lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's package.json file.

References

nvd.nist.gov/vuln/detail/CVE-2021-34078 · ADVISORY
lifion/lifion-verify-deps commit be1133d · WEB
advisory.checkmarx.net/advisory/CX-2021-4785 · WEB
lifion/lifion-verify-deps · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free