PT-2020-21586 · Npm · Static-Eval
Published
2020-09-02
·
Updated
2020-09-02
CVSS v3.1
7.3
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
static-eval versions prior to 2.0.2
Description
The issue allows arbitrary code execution when untrusted user input is parsed via the package, as it passes the input directly to the global function constructor. This can be exploited when user input is evaluated, potentially leading to malicious actions.
Recommendations
Upgrade to version 2.0.2 or later.
Fix
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Static-Eval