GCVE-110-VULN-NPM-2026-000174

Advisory PublishedCVSS 4.2/10

Vulnetix · Advisory published October 19, 2026

[P-NPM-HOOK-NODE-EVAL] lifecycle install hook executes inline node code (node -e/--eval) — matched: postinstall: node -e "const fs=require('fs'); if(fs.existsSync('dist/postinstall.js')){import('./dist/postinstall.js').then(m=>m.runPostinstall()).then(c=>process.exit(c)).catch(()=>process.exit(0))}"

Download JSON Open in Console

Weaknesses (CWE)

CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Risk Scores

CVSS 3.1

4.2/10

Medium · CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Affected Products

Vendor	Product	Versions	Platforms
npm	@sushanglewis/lincoln	1.10.0 (affected)	—

References

advisory

web

Browse GCVE Records

2,491 records in the GCVE database · Updated October 19, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON