lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's package.json file.
CVSS 3.1HIGH 8.8·Network·No auth·User interaction·EPSS 0.02409·Published 2022-06-01·Fixed in 1.2.0CWE-78