CVE-2021-34078: OS Command Injection in lifion-verify-deps
Summary
CVE-2021-34078: OS Command Injection in lifion-verify-deps. Affects lifion-verify-deps versions < 1.2.0. Fixed in 1.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lifion-verify-deps is an npm package used for verifying dependencies in a project. It scans the project's package.json file to ensure that all dependencies are up to date and secure. However, versions up to 1.1.0 are vulnerable to OS command injection. This means that an attacker can execute arbitrary commands on the host system by crafting a malicious dependency name in the package.json file.
Vulnerability Detail
The OS command injection vulnerability in lifion-verify-deps allows an attacker to execute arbitrary commands on the host system. By manipulating the dependency name in the package.json file, an attacker can inject malicious commands that will be executed when the lifion-verify-deps tool is run. This can lead to various security risks, including unauthorized access, data breaches, and system compromise.
How To Fix
Latest published version: 2.0.1 as of 22 Oct 2026
npm install lifion-verify-deps@2.0.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.0
This is the first release that contains the fix.
npm install lifion-verify-deps@1.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of lifion-verify-deps to mitigate the risk of OS command injection.
Conclusion
lifion-verify-deps versions up to 1.1.0 are vulnerable to OS command injection, which can lead to unauthorized access, data breaches, and system compromise. It is highly recommended to upgrade to version 1.2.0 or later to fix this vulnerability. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lifion-verify-deps →
FAQ
lifion-verify-deps is an npm package used for verifying dependencies in a project. It scans the project's package.json file to ensure that all dependencies are up to date and secure.
The OS command injection vulnerability in lifion-verify-deps occurs when a crafted dependency name is provided in the package.json file. This allows an attacker to execute arbitrary commands on the host system.
The OS command injection vulnerability in lifion-verify-deps can lead to unauthorized access, data breaches, and system compromise. An attacker can execute arbitrary commands on the host system, potentially gaining full control over the system.
Yes, a fix is available for this vulnerability. It is recommended to upgrade to version 1.2.0 or later of lifion-verify-deps to mitigate the risk of OS command injection.
There are no known workarounds for this vulnerability. It is crucial to upgrade to the fixed version of lifion-verify-deps to ensure the security of the system.
