Risk of code injection

Description

Some routes use eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side security issues

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.0.0

References

• GHSA-pgjj-866w-fc5c
• www.npmjs.com
• CVE-2021-21278
• CWE-74
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Angular Expressions - Remote Code Execution - CVE-2021-21277
• Command Injection Vulnerability in systeminformation - CVE-2021-21388
• Command Injection in @theia/messages - CVE-2021-28162
• Code Injection in cd-messenger - CVE-2020-7675

Tags:

npm

rsshub