CVE-2022-25921

Arbitrary Code Execution

CVSS 8.1 HIGHEPSS 1.1%

All versions of package morgan-json are vulnerable to Arbitrary Code Execution due to missing sanitization of input passed to the Function constructor.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Produtos afetados

n/a · morgan-json

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/indexzero/morgan-json/blob/3a76010215a4256d41687d082cd66c4f00ea5717/index.js%23L46 https://security.snyk.io/vuln/SNYK-JS-MORGANJSON-2976193