{"id":"CVE-2021-34078","aliases":["GHSA-rphm-c8gw-3r38"],"url":"https://o3.security/vulnerability/CVE-2021-34078","summary":"OS Command Injection in lifion-verify-deps","details":"lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's package.json file.","published":"2022-06-02T14:15:28.757Z","modified":"2026-07-08T22:14:05.692531Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":{"score":0.02564,"percentile":0.84358,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"npm","name":"lifion-verify-deps","fixedVersion":"1.2.0"}],"fix":{"url":"https://github.com/lifion/lifion-verify-deps/commit/be1133d5b78e3caa0004fa60207013dca4e1bf38","label":"lifion/lifion-verify-deps@be1133d"},"references":[{"type":"FIX","url":"https://advisory.checkmarx.net/advisory/CX-2021-4785"},{"type":"FIX","url":"https://github.com/lifion/lifion-verify-deps/commit/be1133d5b78e3caa0004fa60207013dca4e1bf38"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T22:14:05.692531Z"}}