by Kastro
Paper/Archive/CVE-2022-21122

CVE-2022-21122

snyk — Arbitrary Code Execution

EPSS 3%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 85.8.858 × 2017.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor.

Affected

ProductAffectedFixed inSource
metacalcunspecified – < 0.0.20.0.2CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
snyk (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P

References

refsnyk.io/vuln/SNYK-JS-METACALC-2826197refgithub.com/metarhia/metacalc/pull/16refgithub.com/metarhia/metacalc/commit/625c23d63eabfa16fc815f5832b147b08d2144bd