CVE-2021-26276

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

scripts/cli.js in the GoDaddy node-config-shield (aka Config Shield) package before 0.2.2 for Node.js calls eval when processing a set command. NOTE: the vendor reportedly states that this is not a vulnerability. The set command was not intended for use with untrusted data

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-913

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://advisory.checkmarx.net/advisory/CX-2021-4773Exploit, Third Party Advisory
https://github.com/godaddy/node-config-shield/commit/cdba5d3a7accd661ffbc52e208153464bd0d9da6Patch, Third Party Advisory
https://advisory.checkmarx.net/advisory/CX-2021-4773Exploit, Third Party Advisory
https://github.com/godaddy/node-config-shield/commit/cdba5d3a7accd661ffbc52e208153464bd0d9da6Patch, Third Party Advisory

Timeline

Published: Jan 27, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-262779.8The framework service handles pendingIntent incorrectly, allowing a malicious application with certain privileges to perform privileged acti CVE-2021-262786.3The wifi module exposes the interface and has improper permission control, leaking sensitive information about the device.CVE-2021-262795.9Some parameters of the weather module are improperly stored, leaking some sensitive information.CVE-2021-262807.9Locally installed application can bypass the permission check and perform system operations that require permission.CVE-2021-262815.5Some parameters of the alarm clock module are improperly stored, leaking some sensitive information.CVE-2021-262919.1Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, r CVE-2021-262939.8An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversa CVE-2021-262947.5An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files (such CVE-2021-262959.8Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over CVE-2021-262967.5In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cr CVE-2021-263036.1PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the user-profile.php Full Name field.CVE-2021-263045.4PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the add-expense.php Item parameter.