CVE-2021-26276

Name of the Vulnerable Software and Affected Versions node-config-shield versions prior to 0.2.2

Description The issue concerns the node-config-shield package, where the scripts/cli.js file calls eval when processing a set command. This could potentially lead to issues if the set command is used with untrusted data. However, the vendor reportedly states that this is not a vulnerability, as the set command was not intended for use with untrusted data.

Recommendations For versions prior to 0.2.2, consider updating to version 0.2.2 or later to mitigate the risk associated with the use of eval when processing the set command. As a temporary workaround, consider restricting the use of the set command to trusted data only until a patch or update is applied.