GitHub Advisoryadvisory · npm
GHSA-cwcp-6c48-fm7m Unsafe eval() in summit allows arbitrary code execution
CRITICAL
Official page ↗
- Aliases
- CVE-2017-16020
- Ecosystem
- npm
- Packages
- summit
- Severity
- Critical
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-94
- Reviewed
- 2020-08-31
Affected packages
• npm summit: >= 0.1.0, <= 0.1.22 (no fix yet)
Description
Affected versions of `summit` allow attackers to execute arbitrary commands via collection names when using the `PouchDB` driver.
Recommendation
No direct patch is available at this time.
Currently, the best option to mitigate the issue is to avoid using the `PouchDB` driver, as the package author has abandoned this feature entirely.
Related
Alias · CVE (1)
- CVE-2017-16020 Summit is a node web framework. vulnerability
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness