CVE-2022-21122

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-21122

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-21122.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-21122

Aliases

GHSA-5gc4-cx9x-9c43
SNYK-JS-METACALC-2826197

Published

2022-06-03T20:05:12.139Z

Modified

2026-08-12T03:51:40.160401310Z

Severity

9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P CVSS Calculator

Summary

Arbitrary Code Execution

Details

The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21122.json",
    "cna_assigner": "snyk"
}

References

Affected packages

Git / github.com/metarhia/metacalc

Affected ranges

Type

GIT

Repo

https://github.com/metarhia/metacalc

Events

Introduced

Fixed

940be866d58a908507aa61611ba158752175d425

Fixed

625c23d63eabfa16fc815f5832b147b08d2144bd

Database specific

Show details

{
    "cpe": "cpe:2.3:a:metarhia:metacalc:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.0.2"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v0.*

v0.0.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-21122.json"