React Editable Json Tree vulnerable to arbitrary code execution via function parsing

Description

Our library allows strings to be parsed as functions and stored as a specialized component, JsonFunctionValue. To do this, Javascript’s eval function was used to execute strings that begin with “function” as Javascript.

Recommendation

Update the react-editable-json-tree package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.2.2
• Patched version(s): 2.2.2

References

• GHSA-j3rv-w43q-f9x2
• CVE-2022-36010
• CWE-95
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering - CVE-2025-54075
• Improper Verification of Cryptographic Signature in node-forge (GHSA-cfm4-qjh2-4765) - CVE-2022-24771
• DOM Clobbering Gadget found in Rspack's AutoPublicPathRuntimeModule that leads to XSS - Vulnerability
• Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) - CVE-2023-34092

Tags:

npm

react-editable-json-tree