What is GHSA-5gc4-cx9x-9c43?

GHSA-5gc4-cx9x-9c43 is a security advisory published by GitHub Security Advisories with Critical severity. Code Injection in metacalc

Which CVE IDs does GHSA-5gc4-cx9x-9c43 cover?

GHSA-5gc4-cx9x-9c43 covers the following CVE IDs: CVE-2022-21122. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5gc4-cx9x-9c43?

GHSA-5gc4-cx9x-9c43 has a CVSS v3 base score of 9.0, published by GitHub Security Advisories.

Which products are affected by GHSA-5gc4-cx9x-9c43?

GHSA-5gc4-cx9x-9c43 affects 1 product, including: npm/metacalc:\u003c 0.0.2.

GHSA-5gc4-cx9x-9c43CriticalCVSS 9.0

Code Injection in metacalc

Vendor

GitHub Security Advisories

Published

June 9, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-21122 →

📋 Description

The package metacalc before 0.0.2 is vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor.

🎯 Affected products1

npm/metacalc:< 0.0.2

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2022-21122
https://github.com/metarhia/metacalc/pull/16
https://github.com/metarhia/metacalc/commit/625c23d63eabfa16fc815f5832b147b08d2144bd
https://snyk.io/vuln/SNYK-JS-METACALC-2826197
https://github.com/advisories/GHSA-5gc4-cx9x-9c43