GHSA-g4xj-wcq6-qwx5
Code injection in mock2easy
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
This affects all versions up to and including version 0.0.24 of package mock2easy. a malicious user could inject commands through the `_data` variable:
Affected Area
```js
require('../server/getJsonByCurl')(mock2easy, function(error, stdout) {
if (error) {
return res.json(500, error);
}
res.json(JSON.parse(stdout));
}, '', _data.interfaceUrl, query, _data.cookie, _data.interfaceType);```
References
External links from the advisory. They lead to third-party sites.