Description

All versions of package morgan-json are vulnerable to Arbitrary Code Execution due to missing sanitization of input passed to the Function constructor.

Remediation

References

https://github.com/indexzero/morgan-json/blob/3a76010215a4256d41687d082cd66c4f00ea5717/index.js%23L46

https://security.snyk.io/vuln/SNYK-JS-MORGANJSON-2976193

Related Vulnerabilities

CVE-2020-7753 Vulnerability in npm package trim

CVE-2020-9447 Vulnerability in maven package com.googlecode.gwtupload:gwtupload-samples

CVE-2020-8237 Vulnerability in maven package org.webjars.bower:json-bigint

CVE-2020-12668 Vulnerability in maven package com.hubspot.jinjava:jinjava

CVE-2022-24802 Vulnerability in npm package deepmerge-ts

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Broken Link Exploit Third Party Advisory NVD-CWE-Other