Code Injection in node-rules

Description

node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function “fromJSON()” can be controlled by users without any sanitization.

Recommendation

Update the node-rules package to the latest compatible version. Followings are version details:

• Affected version(s): >= 3.0.0, < 5.0.0
• Patched version(s): 5.0.0

References

• GHSA-f78f-353m-cf4j
• snyk.io
• CVE-2020-7609
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Code Injection in mquery - CVE-2020-35149
• xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection - xmlhttprequest - CVE-2020-28502
• Code Injection in mosc - CVE-2020-7672
• Code Injection in cd-messenger - CVE-2020-7675

You might also like:

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

node-rules