PT-2018-4726 · Npm · Reduce-Css-Calc

Chalker · Published 2018-05-31 · Updated 2019-10-09 · CVE-2016-10548

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions reduce-css-calc versions <=1.2.4

Description Arbitrary code execution is possible through crafted CSS, making cross-site scripting (XSS) possible on the client and arbitrary code injection possible on the server. This occurs because user input is passed to the calc function, and affected versions of reduce-css-calc pass input directly to eval. If user input is passed into the calc function, this may result in cross-site scripting on the browser or remote code execution on the server.

Recommendations For versions <=1.2.4, update to version 1.2.5 or later. As a temporary workaround, consider restricting the use of the calc function to minimize the risk of exploitation. Avoid passing user input to the calc function until the issue is resolved.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2016-10548

GHSA-4662-J96G-MV46

Affected Products

Reduce-Css-Calc

References · 7

• 🔥 https://nodesecurity.io/advisories/144 · Exploit
• 🔥 https://gist.github.com/ChALkeR/415a41b561ebea9b341efbb40b802fc9 · Exploit
• https://osv.dev/vulnerability/CVE-2016-10548 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10548 · Security Note
• https://osv.dev/vulnerability/GHSA-4662-j96g-mv46 · Vendor Advisory
• https://github.com/advisories/GHSA-4662-j96g-mv46 · Note
• https://npmjs.com/advisories/144 · Note