CVE-2026-15033

Name of the Vulnerable Software and Affected Versions christopherthielen check-peer-dependencies versions prior to 4.3.5

Description An OS command injection flaw exists in the peerDependencies component within the dist/packageUtils.js file. The issue resides in the shelljs.exec() function, which allows a remote attacker to execute arbitrary operating system commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the shelljs.exec() function in the dist/packageUtils.js file to minimize the risk of exploitation.