Skip to content

Code injection in nobelprizeparser

Critical
AnneTheDev published GHSA-4wv4-mgfq-598v Feb 23, 2021

Package

npm nobelprizeparser (npm)

Affected versions

< 1.0.2

Patched versions

1.0.2

Description

Code injection through use of eval.

Severity

Critical

CVE ID

No known CVE

Weaknesses

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. Learn more on MITRE.