React Editable Json Tree vulnerable to arbitrary code execution via function parsing

Description

Our library allows strings to be parsed as functions and stored as a specialized component, JsonFunctionValue. To do this, Javascript’s eval function was used to execute strings that begin with “function” as Javascript.

Recommendation

Update the react-editable-json-tree package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.2.2
• Patched version(s): 2.2.2

References

• GHSA-j3rv-w43q-f9x2
• CVE-2022-36010
• CWE-95
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Joplin is vulnerable to arbitrary code execution - CVE-2022-35131
• seroval Affected by Remote Code Execution via JSON Deserialization - CVE-2026-23737
• Eta vulnerable to Code Injection via templates rendered with user-defined data - CVE-2022-25967
• Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix) - CVE-2026-73649

You might also like:

SmartScanner Version 1.15 Released

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

react-editable-json-tree