high8.8
CVE-2021-34078
OS Command Injection in lifion-verify-deps
Impact
lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's package.json file.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | lifion-verify-deps | < 1.2.0 | 1.2.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Adp | Lifion-Verifiy-Dependencies | before 1.2.0 |