node-import `params` argument can be controlled by users without any sanitization

Description

This affects all versions of package node-import. The params argument of module function can be controlled by users without any sanitization. This is then provided to the “eval” function located in line 79 in the index file index.js.

Recommendation

No fix is available yet. Followings are affected versions:

<= 0.9.2

References

GHSA-pc62-cq5x-3j5g
security.snyk.io
CVE-2020-7678
CAPEC-310
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for node-import `params` argument can be controlled by users without any sanitization and gives you actionable findings to investigate.

Start a free scan

Related Issues

Prototype pollution in controlled-merge - CVE-2020-28268
Electerm users can run dangrous code through link or command line - CVE-2026-43944
Improper Validation and Sanitization in url-parse - CVE-2020-8124
Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry - CVE-2026-59891

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated January 27, 2023