Improper Input Validation in access-policy

Description

access-policy through 3.1.0 is vulnerable to Arbitrary Code Execution. User input provided to the template function is executed by the eval function resulting in code execution.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 3.1.0

References

• GHSA-fw2f-7f87-5r6c
• snyk.io
• CVE-2020-7674
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Improper Input Validation in klona - CVE-2020-8125
• Improper Input Validation in SocksJS-Node - CVE-2020-7693
• Improper Input Validation in Google Closure Library - CVE-2020-8910
• Improper Input Validation in Deap - CVE-2018-3749

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

access-policy