Description

This affects all versions of package node-import. The "params" argument of module function can be controlled by users without any sanitization.b. This is then provided to the “eval” function located in line 79 in the index file "index.js".

Remediation

References

https://security.snyk.io/vuln/SNYK-JS-NODEIMPORT-571691

https://github.com/mahdaen/node-import/blob/master/index.js%23L79

Related Vulnerabilities

CVE-2020-7757 Vulnerability in npm package droppy

CVE-2020-28481 Vulnerability in maven package org.webjars.npm:socket.io

CVE-2021-28100 Vulnerability in maven package com.netflix.priam:priam

CVE-2022-3423 Vulnerability in npm package nocodb

CVE-2022-24740 Vulnerability in npm package @plone/volto

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Third Party Advisory Broken Link NVD-CWE-noinfo