by Kastro
Paper/Archive/CVE-2022-25760

CVE-2022-25760

snyk — Arbitrary Code Injection

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 76.4.764 × 2015.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If (attacker-controlled) user input is given to the format option of the package's exported constructor function, it is possible for an attacker to execute arbitrary JavaScript code on the host that this package is being run on.

Affected

ProductAffectedFixed inSource
accesslog< unspecifiedunspecifiedCNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
snyk (CNA)7.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L/E:P

References

refsnyk.io/vuln/SNYK-JS-ACCESSLOG-2312099refgithub.com/carlos8f/node-accesslog/blob/master/lib/compile.js%23L6