GHSA-pc62-cq5x-3j5g
node-import `params` argument can be controlled by users without any sanitization
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | node-import | <= 0.9.2 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
This affects all versions of package node-import. The `params` argument of module function can be controlled by users without any sanitization. This is then provided to the “eval” function located in line 79 in the index file `index.js`.
References
External links from the advisory. They lead to third-party sites.