Code Injection in mosc

Description

mosc through 1.0.0 is vulnerable to Arbitrary Code Execution. User input provided to properties argument is executed by the eval function, resulting in code execution.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.0.0

References

• GHSA-j665-rvj7-2jv9
• snyk.io
• CVE-2020-7672
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Code Injection in cryo - CVE-2018-3784
• openssl.js is malware - CVE-2017-16065
• Open Redirect in urijs - CVE-2022-0868
• Code Injection in jsen - CVE-2020-7777

Tags:

npm

mosc