GitHub Advisoryadvisory · npm

GHSA-3qh4-r86r-grvm Arbitrary JavaScript Execution in typed-function

HIGH Published 2020-09-02 Modified 2020-08-31 Official page ↗
Aliases
CVE-2017-1001004
Ecosystem
npm
Packages
typed-function
Severity
High
Weaknesses
CWE-94
Reviewed
2020-08-31

Affected packages

• npm typed-function: < 0.10.6 → fixed in 0.10.6

Description

Versions of `typed-function` prior to 0.10.6 are vulnerable to Arbitrary JavaScript Execution. Function names are not properly sanitized and may allow an attacker to execute arbitrary code. Recommendation Upgrade to version 0.10.6 or later.

Related

Alias · CVE (1)

  • CVE-2017-1001004 typed-function before 0.10.6 had an arbitrary code execution in the JavaScript engine. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References