GHSA-8m2f-74r2-x3f2

Code injection in accesslog

Source: GitHub Advisory Database (reviewed) High CVE-2022-25760

Packages

Ecosystem	Package	Affected	Fixed in
npm	accesslog	<= 0.0.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If (attacker-controlled) user input is given to the format option of the package's exported constructor function, it is possible for an attacker to execute arbitrary JavaScript code on the host that this package is being run on.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-25760 advisory
https://github.com/carlos8f/node-accesslog package
https://github.com/carlos8f/node-accesslog/blob/master/lib/compile.js%23L6 web
https://snyk.io/vuln/SNYK-JS-ACCESSLOG-2312099 web