CVE-2026-15033

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-15033
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15033.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-15033
Published
2026-07-08T13:15:07.664Z
Modified
2026-07-15T01:48:52.596702161Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X CVSS Calculator
Summary
christopherthielen check-peer-dependencies peerDependencies packageUtils.js shelljs.exec os command injection
Details

A flaw has been found in christopherthielen check-peer-dependencies up to 4.3.4. Affected by this vulnerability is the function shelljs.exec of the file dist/packageUtils.js of the component peerDependencies. This manipulation causes os command injection. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "cwe_ids": [
        "CWE-77",
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15033.json",
    "cna_assigner": "VulDB"
}
References

Affected packages

Git / github.com/christopherthielen/check-peer-dependencies

Affected ranges

Type
GIT
Repo
https://github.com/christopherthielen/check-peer-dependencies
Events
Introduced
eeb2e3e656f93377c8649ed1822224327babc18d
Last affected
d1a728c8e7157b171e766d58dc1e36d0458c3253
Database specific 
{
    "extracted_events": [
        {
            "introduced": "4.3.0"
        },
        {
            "last_affected": "4.3.0"
        },
        {
            "introduced": "4.3.1"
        },
        {
            "last_affected": "4.3.1"
        },
        {
            "introduced": "4.3.2"
        },
        {
            "last_affected": "4.3.2"
        },
        {
            "introduced": "4.3.3"
        },
        {
            "last_affected": "4.3.3"
        },
        {
            "introduced": "4.3.4"
        },
        {
            "last_affected": "4.3.4"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

4.*
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15033.json"