~ / search / GHSA-cg42-4wrc-gp47

GHSA-cg42-4wrc-gp47

Code Injection in node-extend

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-7673

Packages

EcosystemPackageAffectedFixed in
npm node-extend <= 0.2.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution. User input provided to the argument `A` of `extend` function`(A,B,as,isAargs)` located within `lib/extend.js` is executed by the `eval` function, resulting in code execution.

References

External links from the advisory. They lead to third-party sites.