In eslint-utils before 1.4.1, the getStaticValue function can execute arbitrary code.
{
"source": "CPE_RANGE",
"cpe": "cpe:2.3:a:eslint-utils_project:eslint-utils:*:*:*:*:*:node.js:*:*",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "1.4.1"
}
]
}