PT-2022-9061 · Unknown · Node-Import

Published 2022-07-25 · Updated 2022-08-01 · CVE-2020-7678

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions node-import versions all

Description The issue affects the params argument of a module function, which can be controlled by users without proper sanitization. This unsanitized input is then passed to the eval function, located in line 79 of the index.js file.

Recommendations For all versions, consider restricting or sanitizing user input to the params argument to prevent exploitation until a proper fix is applied. As a temporary workaround, consider disabling the eval function call in the index.js file at line 79 to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2020-7678

GHSA-PC62-CQ5X-3J5G

Affected Products

Node-Import

References · 5

• 🔥 https://security.snyk.io/vuln/SNYK-JS-NODEIMPORT-571691 · Exploit
• https://osv.dev/vulnerability/GHSA-pc62-cq5x-3j5g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7678 · Security Note
• https://github.com/mahdaen/node-import · Note
• https://github.com/mahdaen/node-import/blob/master/index.js%23L79 · Note