Christopher Thielen Check-Peer-Dependencies OS Command Injection Vulnerability

A command injection vulnerability has been identified in Christopher Thielen's 'check-peer-dependencies' package, specifically in version 4.3.4. The issue arises in the 'peerDependencies' handling, where package names are extracted from 'package.json' and interpolated into shell commands. This flaw allows for the execution of arbitrary operating system commands, potentially initiated remotely. The vulnerability was reported to the project, but no response has been received.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution, with the potential for remote exploitation.

Reproduction

The vulnerability can be reproduced by creating a 'package.json' file with malicious 'peerDependencies' that include shell metacharacters. When 'check-peer-dependencies' is run with the '--findSolutions' or '--install' options, the tool will execute commands that include the injected metacharacters, leading to command injection.