Code injection in mock2easy

Description

This affects all versions up to and including version 0.0.24 of package mock2easy. a malicious user could inject commands through the _data variable:

Affected Area

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.0.24

References

• GHSA-g4xj-wcq6-qwx5
• snyk.io
• www.npmjs.com
• CVE-2020-7697
• CWE-77
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Code Injection in node-rules - CVE-2020-7609
• Code Injection in mosc - CVE-2020-7672
• xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection - xmlhttprequest - CVE-2020-28502
• xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection - CVE-2020-28502

You might also like:

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

mock2easy