Description
node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function “fromJSON()” can be controlled by users without any sanitization.
Recommendation
Update the node-rules package to the latest compatible version. Followings are version details:
- Affected version(s): >= 3.0.0, < 5.0.0
- Patched version(s): 5.0.0
References
Could your website be exposed too?
SmartScanner can check your website for Code Injection in node-rules and gives you actionable findings to investigate.
Start a free scanRelated Issues
- xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection - CVE-2020-28502
- Code Injection in cd-messenger - CVE-2020-7675
- Code Injection in mosc - CVE-2020-7672
- xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection - xmlhttprequest - CVE-2020-28502
You might also like:
See something that needs correcting? Let us knowUpdated January 23, 2026