Description
Our library allows strings to be parsed as functions and stored as a specialized component, JsonFunctionValue. To do this, Javascript’s eval function was used to execute strings that begin with “function” as Javascript.
Recommendation
Update the react-editable-json-tree package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.2.2
- Patched version(s): 2.2.2
References
Could your website be exposed too?
SmartScanner can check your website for React Editable Json Tree vulnerable to arbitrary code execution via function parsing and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Joplin is vulnerable to arbitrary code execution - CVE-2022-35131
- seroval Affected by Remote Code Execution via JSON Deserialization - CVE-2026-23737
- Eta vulnerable to Code Injection via templates rendered with user-defined data - CVE-2022-25967
- Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix) - CVE-2026-73649
You might also like:
See something that needs correcting? Let us knowUpdated January 30, 2023