Description
Versions of hot-formula-parser prior to 3.0.1 are vulnerable to Command Injection. The package fails to sanitize values passed to the parse function and concatenates it in an eval call. If a value of the formula is supplied by user-controlled input it may allow attackers to run arbitrary commands in the server.
Recommendation
Update the hot-formula-parser package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.0.1
- Patched version(s): 3.0.1
References
- GHSA-rc77-xxq6-4mff
- blog.truesec.com
- www.npmjs.com
- CVE-2020-6836
- CWE-94
- CAPEC-310
- OWASP 2021-A3
- OWASP 2021-A6
Related Issues
- pg-promise SQL Injection vulnerability - CVE-2025-29744
- njwt Prototype Pollution vulnerability - CVE-2024-34273
- Elliptic allows BER-encoded signatures - CVE-2024-42461
- ejs lacks certain pollution protection - CVE-2024-33883
- Tags:
- npm
- hot-formula-parser
Anything's wrong? Let us know Last updated on January 09, 2023