GHSA-cg42-4wrc-gp47CriticalCVSS 9.8

Code Injection in node-extend

Published
May 17, 2021
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

📋 Description

node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution. User input provided to the argument A of extend function(A,B,as,isAargs) located within lib/extend.js is executed by the eval function, resulting in code execution.

🎯 Affected products1

  • npm/node-extend:<= 0.2.0

🔗 References (3)