# Risk map — eslint/eslint

> Canonical page: https://codevetter.com/unpack/eslint/risk-map

# Risk map — eslint/eslint

Scanned commit bc51eee6e3e816622b2dd1bc08acb9cfb2d3a6a7 (2026-10-02). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

These observations identify execution and persistence boundaries requiring care; they are not confirmed vulnerabilities. Configuration and extension modules execute within the host process, and convenience commands can invoke external package tooling. Filesystem destinations are resolved from caller-controlled paths rather than constrained to a repository root. Fixing, caching, suppressions, and concurrency have conditions that can materially change results or side effects.
- Configuration discovery searches upward from target directories and imports executable modules; explicit config paths resolve against cwd, so config loading can cross the repository boundary. — [lib/config/config-loader.js#L539-550](https://github.com/eslint/eslint/blob/bc51eee6e3e816622b2dd1bc08acb9cfb2d3a6a7/lib/config/config-loader.js#L539-L550) [lib/config/config-loader.js#L184-189](https://github.com/eslint/eslint/blob/bc51eee6e3e816622b2dd1bc08acb9cfb2d3a6a7/lib/config/config-loader.js#L184-L189) [lib/config/config-loader.js#L198-234](https://github.com/eslint/eslint/blob/bc51eee6e3e816622b2dd1bc08acb9cfb2d3a6a7/lib/config/config-loader.js#L198-L234)
- CLI parser/plugin selection and formatter loading import caller-selected modules; imported code therefore participates in the host runtime rather than a separate analysis sandbox. — [lib/shared/translate-cli-options.js#L36-52](https://github.com/eslint/eslint/blob/bc51eee6e3e816622b2dd1bc08acb9cfb2d3a6a7/lib/shared/translate-cli-options.js#L36-L52) [lib/shared/translate-cli-options.js#L145-146](https://github.com/eslint/eslint/blob/bc51eee6e3e816622b2dd1bc08acb9cfb2d3a6a7/lib/shared/translate-cli-options.js#L145-L146) [lib/eslint/eslint.js#L1246-1273](https://github.com/eslint/eslint/blob/bc51eee6e3e816622b2dd1bc08acb9cfb2d3a6a7/lib/eslint/eslint.js#L1246-L1273)
- --init and --mcp synchronously spawn npm/npx with inherited stdio and propagate status/signals; --inspect-config similarly invokes npx. These paths delegate package acquisition/execution to external tools. — [bin/eslint.js#L71-87](https://github.com/eslint/eslint/blob/bc51eee6e3e816622b2dd1bc08acb9cfb2d3a6a7/bin/eslint.js#L71-L87) [bin/eslint.js#L168-186](https://github.com/eslint/eslint/blob/bc51eee6e3e816622b2dd1bc08acb9cfb2d3a6a7/bin/eslint.js#L168-L186) [lib/cli.js#L267-278](https://github.com/eslint/eslint/blob/bc51eee6e3e816622b2dd1bc08acb9cfb2d3a6a7/lib/cli.js#L267-L278)
- outputFixes() writes any result containing string output and an absolute filePath; report output resolves against process.cwd() and creates parent directories. Neither shown writer enforces a repository-root boundary. — [lib/eslint/eslint.js#L802-824](https://github.com/eslint/eslint/blob/bc51eee6e3e816622b2dd1bc08acb9cfb2d3a6a7/lib/eslint/eslint.js#L802-L824) [lib/cli.js#L120-136](https://github.com/eslint/eslint/blob/bc51eee6e3e816622b2dd1bc08acb9cfb2d3a6a7/lib/cli.js#L120-L136)
- lintFiles() can delete the resolved cache file when caching is disabled; getCacheFile() accepts absolute or cwd-relative destinations, making cacheLocation relevant even outside cache-enabled runs. — [lib/eslint/eslint.js#L1009-1021](https://github.com/eslint/eslint/blob/bc51eee6e3e816622b2dd1bc08acb9cfb2d3a6a7/lib/eslint/eslint.js#L1009-L1021) [lib/eslint/eslint-helpers.js#L1009-1017](https://github.com/eslint/eslint/blob/bc51eee6e3e816622b2dd1bc08acb9cfb2d3a6a7/lib/eslint/eslint-helpers.js#L1009-L1017)
- Autofix convergence is bounded and detects return to text from two iterations earlier; fix-range application rejects conflicts. The implementation does not establish general convergence or semantic equivalence of rule-provided fixes. — [lib/linter/linter.js#L1547-1554](https://github.com/eslint/eslint/blob/bc51eee6e3e816622b2dd1bc08acb9cfb2d3a6a7/lib/linter/linter.js#L1547-L1554) [lib/linter/linter.js#L1622-1637](https://github.com/eslint/eslint/blob/bc51eee6e3e816622b2dd1bc08acb9cfb2d3a6a7/lib/linter/linter.js#L1622-L1637) [lib/linter/source-code-fixer.js#L86-109](https://github.com/eslint/eslint/blob/bc51eee6e3e816622b2dd1bc08acb9cfb2d3a6a7/lib/linter/source-code-fixer.js#L86-L109)
- Suppression loading performs JSON.parse() without shape validation in load(), and save() directly overwrites the file. Hypothesis: malformed-but-valid JSON or interrupted/concurrent writes merit focused robustness checks; these were not demonstrated failures. (inferred) — [lib/services/suppressions-service.js#L215-243](https://github.com/eslint/eslint/blob/bc51eee6e3e816622b2dd1bc08acb9cfb2d3a6a7/lib/services/suppressions-service.js#L215-L243) [lib/services/suppressions-service.js#L163-174](https://github.com/eslint/eslint/blob/bc51eee6e3e816622b2dd1bc08acb9cfb2d3a6a7/lib/services/suppressions-service.js#L163-L174)
- The low-overhead visitor branch tags listener functions with rule IDs and falls back to wrappers when functions are shared across rules; changes here must preserve attribution for shared visitors, timing, and statistics. — [lib/linter/linter.js#L678-713](https://github.com/eslint/eslint/blob/bc51eee6e3e816622b2dd1bc08acb9cfb2d3a6a7/lib/linter/linter.js#L678-L713)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)