CVE-2021-26276: Godaddy Node-Config-Shield

Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days.

scripts/cli.js in the GoDaddy node-config-shield (aka Config Shield) package before 0.2.2 for Node.js calls eval when processing a set command. NOTE: the vendor reportedly states that this is not a vulnerability. The set command was not intended for use with untrusted data

Affected products

• Godaddy Node-Config-Shield: before 0.2.3 (fixed in 0.2.3)

Published 2021-01-27. Last modified 2026-06-17.