GitHub Advisoryadvisory · npm

GHSA-5gc4-cx9x-9c43 Code Injection in metacalc

CRITICAL Published 2022-06-09 Modified 2022-06-20 Official page ↗
Aliases
CVE-2022-21122
Ecosystem
npm
Packages
metacalc
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2022-06-09

Affected packages

• npm metacalc: < 0.0.2 → fixed in 0.0.2

Description

The package metacalc before 0.0.2 is vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor.

Related

Alias · CVE (1)

  • CVE-2022-21122 The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References