GCVE-110-VULN-NPM-2026-000203

Advisory PublishedCVSS 4.2/10

Vulnetix · Advisory published October 20, 2026

[P-NPM-HOOK-NODE-EVAL] lifecycle install hook executes inline node code (node -e/--eval) — matched: postinstall: node -e "const fs=require('fs');const path=require('path');const zodPath=path.join('node_modules','zod');if(fs.existsSync(zodPath)){fs.writeFileSync(path.join(zodPath,'v3.js'),'module.exports=require(\"./lib/index.js\");');fs.writeFileSync(path.join(zodPath,'v3.d.ts'),'export * from \".

Download JSON Open in Console

Weaknesses (CWE)

CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Risk Scores

CVSS 3.1

4.2/10

Medium · CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Affected Products

Vendor	Product	Versions	Platforms
npm	elizaos-plugin-pumpdata	0.1.0 (affected)	—

References

advisory

web

Browse GCVE Records

20,225 records in the GCVE database · Updated October 20, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON