CVE-2022-21122
Arbitrary Code Execution
Summary
Arbitrary Code Execution
Original description
The description as published by the source.
The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
npm
metacalc
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.2"}]}]
References
- advisory nvd.nist.gov
- advisory snyk.io
- advisory github.com
- package github.com
- patch github.com
- patch github.com