CVE-2026-15033: OS Command Injection in check-peer-dependencies npm Package

Technical summary

The vulnerability resides in the shelljs.exec() call within dist/packageUtils.js of check-peer-dependencies. The peerDependencies function fails to properly sanitize input before passing it to shell command execution, creating a classic OS command injection vulnerability (CWE-77, CWE-78). An authenticated attacker can manipulate input parameters to break out of the intended command context and inject arbitrary shell commands that execute with the privileges of the Node.js process.

Business impact

Organizations using check-peer-dependencies in development pipelines or CI/CD environments face code execution risk during dependency validation steps. A developer or automated system with package access could inadvertently trigger malicious input, leading to source code exfiltration, build artifact tampering, or lateral movement within development infrastructure. The impact is most severe in shared development environments or when the package is used in supply-chain tooling.

Affected systems

The christopherthielen check-peer-dependencies package is affected in all versions up to and including 4.3.4. The vulnerability is triggered specifically when the peerDependencies analysis function processes untrusted input. Determine your installed version via npm list check-peer-dependencies and verify if it falls within the affected range.

Exploitability

Exploitation requires authenticated access (existing permissions to invoke the package or supply input to it) and relies on network-accessible entry points where user input flows to the vulnerable function. The attack does not require user interaction or special configuration. CVSS 3.1 score of 6.3 (MEDIUM) reflects the authentication requirement coupled with low complexity and scope containment; impact is limited to confidentiality, integrity, and availability of the affected system only.

Remediation

Update check-peer-dependencies to a patched version released after 4.3.4. Contact the project maintainer or monitor the repository for a security release. Until a patch is available, restrict package access to trusted users and avoid processing untrusted input through the peerDependencies function. Consider using npm audit to flag this package in your dependency tree and evaluate whether the package is essential to your workflow.

Patch guidance

Check the christopherthielen/check-peer-dependencies GitHub repository for version releases newer than 4.3.4. The project was notified early but has not yet responded with a fix according to the CVE report. Monitor the repository's issues and releases closely. When a patched version is published, update via npm install check-peer-dependencies@latest and verify the fix in release notes before deploying to production environments.

Detection guidance

Search your npm install trees and lock files for check-peer-dependencies ≤4.3.4 using npm audit and SBOM tools. Monitor execution logs for unexpected shell command sequences or errors from packageUtils.js. In CI/CD logs, watch for shelljs.exec() calls with unusual arguments or command chains. Alert on any deviation in peerDependencies function behavior or unexpected process spawning during dependency checks.

Why prioritize this

Although rated MEDIUM severity, prioritize this vulnerability if you use check-peer-dependencies in automated build or deployment pipelines, especially in multi-tenant or shared development environments. The authentication requirement and process scope limit the CVSS score, but code execution during the build phase can compromise build artifacts, deployment credentials, or downstream systems. High-priority patches should focus on build environments and CI/CD integration points.

Risk score, explained

The CVSS 3.1 score of 6.3 reflects: (1) Network-accessible attack vector (AV:N) with low attack complexity (AC:L), (2) authentication requirement (PR:L) that lowers the score from 9+ to a MEDIUM range, (3) unchanged scope (S:U) limiting impact to the vulnerable component, and (4) low impact on confidentiality, integrity, and availability (C:L/I:L/A:L) constrained to the process context. The score would escalate if the package is used in privileged build processes or with escalated permissions.

Frequently asked questions