GitHub Advisoryadvisory · npm

GHSA-jrvm-mcxc-mf6m dom-iterator code execution vulnerability

MEDIUM Published 2024-11-13 Modified 2025-01-14 Official page ↗
Aliases
CVE-2024-21541
Ecosystem
npm
Packages
dom-iterator
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-94
Reviewed
2024-11-13

Affected packages

• npm dom-iterator: < 1.0.1 → fixed in 1.0.1

Description

Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sanitization. Function generates a new function body and thus care must be given to ensure that the inputs to Function are not attacker-controlled. The risks involved are similar to that of allowing attacker-controlled input to reach eval.

Related

Alias · CVE (1)

  • CVE-2024-21541 Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References