node-import `params` argument can be controlled by users without any sanitization

Description

This affects all versions of package node-import. The params argument of module function can be controlled by users without any sanitization. This is then provided to the “eval” function located in line 79 in the index file index.js.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.9.2

References

• GHSA-pc62-cq5x-3j5g
• security.snyk.io
• CVE-2020-7678
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Prototype pollution in controlled-merge - CVE-2020-28268
• Electerm users can run dangrous code through link or command line - CVE-2026-43944
• Improper Validation and Sanitization in url-parse - CVE-2020-8124
• Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry - CVE-2026-59891

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

node-import