'getStaticValue' function can execute arbitrary code

Critical

mysticatea published GHSA-3gx7-xhv7-5mx3 Aug 20, 2019 · 1 comment

Package

eslint-utils (npm)

Affected versions

>=1.2.0 <1.4.1

Patched versions

1.4.1

Description

Impact

getStaticValue function can execute arbitrary code.

Patches

This problem has been patched in 1.4.1. Please update eslint-utils.

Workarounds

Don't use getStaticValue function, getStringIfConstant function, and getPropertyName function.

For more information

If you have any questions or comments about this advisory:

Open an issue in eslint-utils