Description
node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution. User input provided to the argument `A` of `extend` function`(A,B,as,isAargs)` located within `lib/extend.js` is executed by the `eval` function, resulting in code execution.
Remediation
References
https://snyk.io/vuln/SNYK-JS-NODEEXTEND-571491
Related Vulnerabilities
CVE-2020-36183 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2023-40817 Vulnerability in maven package org.opencrx:opencrx-core-models
CVE-2018-1000023 Vulnerability in npm package insight-api
CVE-2020-7751 Vulnerability in maven package org.webjars.npm:pathval
CVE-2017-16143 Vulnerability in npm package commentapp.stetsonwood