Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS01Z2M0LWN4OXgtOWM0M84AArd5

Code Injection in metacalc

The package metacalc before 0.0.2 is vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor.

Permalink: https://github.com/advisories/GHSA-5gc4-cx9x-9c43
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01Z2M0LWN4OXgtOWM0M84AArd5
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: almost 2 years ago
Updated: over 1 year ago

CVSS Score: 9.1
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Identifiers: GHSA-5gc4-cx9x-9c43, CVE-2022-21122
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-21122
• https://github.com/metarhia/metacalc/pull/16
• https://github.com/metarhia/metacalc/commit/625c23d63eabfa16fc815f5832b147b08d2144bd
• https://snyk.io/vuln/SNYK-JS-METACALC-2826197
• https://github.com/advisories/GHSA-5gc4-cx9x-9c43

Repository: https://github.com/metarhia/metacalc
Blast Radius: 1.0

Affected Packages