Skip to content

Code injection in nobelprizeparser

Critical severity GitHub Reviewed Published Feb 23, 2021 in AnneTheDev/nobelprize • Updated Jan 9, 2023

Package

npm nobelprizeparser (npm)

Affected versions

< 1.0.2

Patched versions

1.0.2

Description

Code injection through use of eval.

References

@AnneTheDev AnneTheDev published to AnneTheDev/nobelprize Feb 23, 2021
Reviewed Mar 12, 2021
Published to the GitHub Advisory Database Mar 12, 2021
Last updated Jan 9, 2023

Severity

Critical

EPSS score

Weaknesses

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. Learn more on MITRE.

CVE ID

No known CVE

GHSA ID

GHSA-4wv4-mgfq-598v

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.