Risk of code injection

Description

Some routes use eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side security issues

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.0.0

References

• GHSA-pgjj-866w-fc5c
• www.npmjs.com
• CVE-2021-21278
• CWE-74
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Code injection in plupload - CVE-2021-23562
• Command injection in launchpad - CVE-2021-23330
• Command Injection in lodash - lodash-es - CVE-2021-23337
• Widget feature vulnerability allowing to execute JavaScript code using undo functionality - CVE-2021-32808

You might also like:

How do hackers hack websites?

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

rsshub