GitHub Advisoryadvisory · npm

GHSA-8m2f-74r2-x3f2 Code injection in accesslog

HIGH Published 2022-03-18 Modified 2022-03-18 Official page ↗
Aliases
CVE-2022-25760
Ecosystem
npm
Packages
accesslog
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Weaknesses
CWE-94
Reviewed
2022-03-18

Affected packages

• npm accesslog: <= 0.0.2 (no fix yet)

Description

All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If (attacker-controlled) user input is given to the format option of the package's exported constructor function, it is possible for an attacker to execute arbitrary JavaScript code on the host that this package is being run on.

Related

Alias · CVE (1)

  • CVE-2022-25760 All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References