CVE-2021-26276

scripts/cli.js in the GoDaddy node-config-shield (aka Config Shield) package before 0.2.2 for Node.js calls eval when processing a set command. NOTE: the vendor reportedly states that this is not a vulnerability. The set command was not intended for use with untrusted data

• CWE-913

• https://advisory.checkmarx.net/advisory/CX-2021-4773Exploit, Third Party Advisory
• https://github.com/godaddy/node-config-shield/commit/cdba5d3a7accd661ffbc52e208153464bd0d9da6Patch, Third Party Advisory
• https://advisory.checkmarx.net/advisory/CX-2021-4773Exploit, Third Party Advisory
• https://github.com/godaddy/node-config-shield/commit/cdba5d3a7accd661ffbc52e208153464bd0d9da6Patch, Third Party Advisory

Published

Jan 27, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-26267cPanel before 92.0.9 allows a MySQL user (who has an old-sty…7.5
• CVE-2021-26271It was possible to execute a ReDoS-type attack inside CKEdit…6.5
• CVE-2021-26272It was possible to execute a ReDoS-type attack inside CKEdit…6.5
• CVE-2021-26273The Agent in NinjaRMM 5.0.909 has Incorrect Access Control.7.8
• CVE-2021-26274The Agent in NinjaRMM 5.0.909 has Insecure Permissions.7.1
• CVE-2021-26275The eslint-fixer package through 0.1.5 for Node.js allows co…9.8
• CVE-2021-26277The framework service handles pendingIntent incorrectly, all…9.8
• CVE-2021-26278The wifi module exposes the interface and has improper permi…6.3
• CVE-2021-26279Some parameters of the weather module are improperly stored,…5.9
• CVE-2021-26280Locally installed application can bypass the permission chec…7.9
• CVE-2021-26281Some parameters of the alarm clock module are improperly sto…5.5
• CVE-2021-26291Apache Maven will follow repositories that are defined in a …9.1