Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTh3aHItdjNnbS13OGg5

Command Injection in node-rules

Versions of node-rules prior to 5.0.0 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an eval call when using the fromJSON function. This may allow attackers to execute arbitrary code in the system if the rules are user-controlled.

Recommendation

Upgrade to version 5.0.0 or later.

Permalink: https://github.com/advisories/GHSA-8whr-v3gm-w8h9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTh3aHItdjNnbS13OGg5
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 3 years ago
Updated: 7 months ago

CVSS Score: 8.1
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L

Identifiers: GHSA-8whr-v3gm-w8h9
References:

• https://github.com/mithunsatheesh/node-rules/issues/84
• https://snyk.io/vuln/SNYK-JS-NODERULES-560426
• https://github.com/mithunsatheesh/node-rules/commit/100862223904bb6478fcc33b701c7dee11f7b832
• https://github.com/advisories/GHSA-8whr-v3gm-w8h9

Repository: https://github.com/mithunsatheesh/node-rules
Blast Radius: 13.4

Affected Packages