PT-2024-18954 · Unknown · Dom-Iterator

Nodemedic-Fine + 1 · Published 2024-11-13 · Updated 2025-01-14 · CVE-2024-21541

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dom-iterator versions prior to 1.0.1

Description The issue is related to Arbitrary Code Execution due to the use of the Function constructor without complete input sanitization. This allows an attacker to generate a new function body, posing risks similar to those of allowing attacker-controlled input to reach eval.

Recommendations For versions prior to 1.0.1, update to version 1.0.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Function constructor to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-21541

GHSA-JRVM-MCXC-MF6M

Affected Products

Dom-Iterator

References · 12

• 🔥 https://security.snyk.io/vuln/SNYK-JS-DOMITERATOR-6157199 · Exploit
• https://osv.dev/vulnerability/CVE-2024-21541 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21541 · Security Note
• https://osv.dev/vulnerability/GHSA-jrvm-mcxc-mf6m · Vendor Advisory
• https://github.com/matthewmueller/dom-iterator · Note
• https://github.com/matthewmueller/dom-iterator/commit/9e0e0fad5a251de5b42feb326c4204eb04080805 · Note
• https://twitter.com/VulmonFeeds/status/1856604644568641866 · Twitter Post
• https://twitter.com/CVEnew/status/1856694178308333787 · Twitter Post
• https://t.me/cvedetector/10803 · Telegram Post
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8383166 · Note
• https://t.me/cvenotify/102157 · Telegram Post
• https://t.me/cvenotify/101503 · Telegram Post