GHSA-5gc4-cx9x-9c43

Code Injection in metacalc

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-21122

Packages

Ecosystem	Package	Affected	Fixed in
npm	metacalc	< 0.0.2	0.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

The package metacalc before 0.0.2 is vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-21122 advisory
https://github.com/metarhia/metacalc/pull/16 web
https://github.com/metarhia/metacalc/commit/625c23d63eabfa16fc815f5832b147b08d2144bd web
https://github.com/metarhia/metacalc package
https://snyk.io/vuln/SNYK-JS-METACALC-2826197 web