CVE-2026-15033: check-peer-dependencies RCE Vulnerability

CVE-2026-15033 Overview

CVE-2026-15033 is an OS command injection vulnerability affecting christopherthielen/check-peer-dependencies versions up to 4.3.4. The flaw resides in the shelljs.exec call inside dist/packageUtils.js, within the peerDependencies component. Attacker-controlled input flows into a shell execution context without proper sanitization, allowing arbitrary command construction. The issue is classified under CWE-77: Improper Neutralization of Special Elements used in a Command. The maintainer was notified through a public issue report but has not responded at the time of publication.

Critical Impact
Attackers can inject arbitrary operating system commands through crafted peer dependency data, leading to unauthorized code execution in the context of the developer or build process running check-peer-dependencies.

Affected Products

christopherthielen/check-peer-dependencies versions up to and including 4.3.4
Node.js projects that invoke check-peer-dependencies during install or build workflows
CI/CD pipelines that consume untrusted package.json peer dependency metadata

Discovery Timeline

2026-07-08 - CVE-2026-15033 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-15033

Vulnerability Analysis

The check-peer-dependencies package inspects and reconciles peer dependency requirements for Node.js projects. During this workflow, the package constructs shell commands and passes them to shelljs.exec inside dist/packageUtils.js. Because peer dependency strings such as package names and version specifiers are concatenated directly into the command string, an attacker who controls those values can break out of the intended argument and append arbitrary shell syntax.

OS command injection ([CWE-77]) in a developer tooling context is particularly consequential. The injected command runs with the privileges of the user executing npm install, npm run, or the CI job invoking the tool. That context frequently holds credentials, SSH keys, and cloud tokens.

Root Cause

The root cause is the unsafe composition of a shell command string in dist/packageUtils.js followed by execution through shelljs.exec. The function does not validate, escape, or parameterize dependency identifiers before shell interpretation, allowing metacharacters such as ;, &&, |, and backticks to alter command semantics.

Attack Vector

The attack originates over the network in the sense that a malicious package.json or an attacker-controlled peer dependency published to a registry can carry the injection payload. When a developer or automated pipeline runs check-peer-dependencies against the malicious manifest, the crafted string is passed to shelljs.exec and the injected commands execute on the host.

Exploitation does not require authentication to the target system. It requires only that the victim process untrusted dependency metadata with a vulnerable version of the tool. See the GitHub issue tracker for the original report describing the sink.

Detection Methods for CVE-2026-15033

Indicators of Compromise

Unexpected child processes spawned by node during npm install, yarn install, or CI build steps that invoke check-peer-dependencies
Outbound network connections initiated from build agents shortly after peer dependency resolution
Shell metacharacters (;, &&, |, backticks, $()) present in peer dependency version fields inside package.json files

Detection Strategies

Perform static analysis of package.json and lockfiles for anomalous peer dependency version strings containing shell control characters
Monitor process trees where node or shelljs spawn shells (sh, bash, cmd.exe) with commands unrelated to package management
Audit dependency graphs to identify projects that transitively depend on check-peer-dependencies at versions <= 4.3.4

Monitoring Recommendations

Enable command-line auditing on developer workstations and build runners to capture full argument strings for shell invocations
Alert on new or unusual outbound connections from CI/CD runners during dependency installation phases
Track process lineage where a Node.js process is the parent of interactive shell utilities such as curl, wget, or credential-access tools

How to Mitigate CVE-2026-15033

Immediate Actions Required

Remove or pin away from check-peer-dependencies versions <= 4.3.4 in all project manifests and lockfiles
Restrict use of the tool to trusted repositories and avoid running it against unvetted package.json inputs
Isolate CI/CD build agents so that a compromised runner cannot reach production secrets or long-lived cloud credentials

Patch Information

At the time of publication no vendor patch is available. The project maintainer has not responded to the disclosure filed in the GitHub Issue Tracker. Consumers should track the GitHub project repository for future releases and validate any fix that replaces shelljs.exec with a safe argument-array execution API.

Workarounds

Replace check-peer-dependencies with an actively maintained alternative such as native npm or pnpm peer dependency resolution
Fork the package locally and refactor the shelljs.exec call in dist/packageUtils.js to use execFile-style APIs that pass arguments as an array rather than a shell string
Run dependency tooling inside ephemeral, network-restricted containers with no access to secrets

bash

# Configuration example: audit installed versions and block vulnerable ranges
npm ls check-peer-dependencies
npm install --save-dev check-peer-dependencies@">4.3.4" || echo "No fixed version available yet"

# Optional: enforce an npm override to prevent transitive installation
# Add to package.json
#   "overrides": {
#     "check-peer-dependencies": "npm:noop-package@1.0.0"
#   }