Code Injection in node-rules

Description

node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function “fromJSON()” can be controlled by users without any sanitization.

Recommendation

Update the node-rules package to the latest compatible version. Followings are version details:

• Affected version(s): >= 3.0.0, < 5.0.0
• Patched version(s): 5.0.0

References

• GHSA-f78f-353m-cf4j
• snyk.io
• CVE-2020-7609
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Denial of Service in jquery - CVE-2016-10707
• gifplayer XSS vulnerability - CVE-2025-31128
• Command Injection in node-rules - Vulnerability
• Prototype pollution in gsap - CVE-2020-28478

Tags:

npm

node-rules