CVE-2022-21122
Arbitrary Code Execution
Résumé
Arbitrary Code Execution
Description d'origine
La description telle que publiée par la source (souvent en anglais).
The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
npm
metacalc
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.2"}]}]
Références
- advisory nvd.nist.gov
- advisory snyk.io
- advisory github.com
- package github.com
- patch github.com
- patch github.com