godaddy/node-config-shield · Security
Improper Control of Dynamically-Managed Code Resources in config-shield
- GHSA ID
- GHSA-w8h4-vw8f-rvvj
- CVE ID
- CVE-2021-26276
- Severity
- medium
- Published
- Updated
- CVSS
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- CVSS v3
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Description
scripts/cli.js in the GoDaddy node-config-shield (aka Config Shield) package before 0.2.2 for Node.js calls eval when processing a set command. NOTE: the vendor reportedly states that this is not a vulnerability. The set command was not intended for use with untrusted data.
CWEs
- CWE-913 · Improper Control of Dynamically-Managed Code Resources