Code Injection in node-rules

Description

node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function “fromJSON()” can be controlled by users without any sanitization.

Recommendation

Update the node-rules package to the latest compatible version. Followings are version details:

• Affected version(s): >= 3.0.0, < 5.0.0
• Patched version(s): 5.0.0

References

• GHSA-f78f-353m-cf4j
• snyk.io
• CVE-2020-7609
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection - CVE-2020-28502
• Code injection in electerm - CVE-2020-23256
• Command Injection in node-rules - Vulnerability
• Code Injection in jsen - CVE-2020-7777

Tags:

npm

node-rules