Description

All versions of package morgan-json are vulnerable to Arbitrary Code Execution due to missing sanitization of input passed to the Function constructor.

Remediation

References

https://security.snyk.io/vuln/SNYK-JS-MORGANJSON-2976193

https://github.com/indexzero/morgan-json/blob/3a76010215a4256d41687d082cd66c4f00ea5717/index.js%23L46

Related Vulnerabilities

CVE-2019-10770 Vulnerability in maven package io.ratpack:ratpack-core

CVE-2017-16197 Vulnerability in npm package qinserve

CVE-2021-23509 Vulnerability in npm package json-ptr

CVE-2021-44908 Vulnerability in npm package sails

CVE-2022-0654 Vulnerability in npm package requestretry

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Third Party Advisory Broken Link NVD-CWE-Other