A flaw in the shelljs.exec function within the check‑peer‑dependencies package allows an adversary to inject arbitrary operating‑system commands. The vulnerability is an OS Command Injection weakness catalogued as CWE‑77 and CWE‑78. When triggered, the underlying node process can execute arbitrary commands, potentially leading to full compromise of confidentiality, integrity, and availability of the host system.

The check‑peer‑dependencies npm package, authored by christopherthielen, is affected in all releases up to and including version 4.3.4. Any JavaScript or Node.js project that imports this package for peer‑dependency checks—common in build pipelines, continuous integration tools, and local development setups—is at risk.

The CVSS score of 5.3 indicates medium severity, while the EPSS score of 1% reflects a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, most often through a publicly accessible npm registry or by an attacker who can influence the contents of a dependency installation, such as via a compromised npm package source or a malicious commit that pulls in a vulnerable version of check‑peer‑dependencies.