Risk of code injection

Description

Some routes use eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side security issues

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.0.0

References

• GHSA-pgjj-866w-fc5c
• www.npmjs.com
• CVE-2021-21278
• CWE-74
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Command Injection Vulnerability in systeminformation - CVE-2021-21388
• Command injection in google-it - CVE-2021-34083
• react-dev-utils OS Command Injection in function `getProcessForPort` - CVE-2021-24033
• Improper Control of Generation of Code ('Code Injection') in @tygo-van-den-hurk/slyde - CVE-2026-26974

You might also like:

How do hackers hack websites?

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

rsshub