Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS01Z2M0LWN4OXgtOWM0M84AArd5

Code Injection in metacalc

The package metacalc before 0.0.2 is vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor.

Permalink: https://github.com/advisories/GHSA-5gc4-cx9x-9c43
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01Z2M0LWN4OXgtOWM0M84AArd5
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 2 years ago
Updated: over 1 year ago


CVSS Score: 9.1
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Identifiers: GHSA-5gc4-cx9x-9c43, CVE-2022-21122
References: Repository: https://github.com/metarhia/metacalc
Blast Radius: 1.0

Affected Packages

npm:metacalc
Dependent packages: 1
Dependent repositories: 0
Downloads: 4 last month
Affected Version Ranges: < 0.0.2
Fixed in: 0.0.2
All affected versions: 0.0.0, 0.0.1
All unaffected versions: 0.0.2