GHSA-3qh4-r86r-grvm

Source

https://github.com/advisories/GHSA-3qh4-r86r-grvm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-3qh4-r86r-grvm/GHSA-3qh4-r86r-grvm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-3qh4-r86r-grvm

Aliases

CVE-2017-1001004

Published

2020-09-02T18:24:39Z

Modified

2023-11-08T03:58:48Z

Summary

Arbitrary JavaScript Execution in typed-function

Details

Versions of typed-function prior to 0.10.6 are vulnerable to Arbitrary JavaScript Execution. Function names are not properly sanitized and may allow an attacker to execute arbitrary code.

Recommendation

Upgrade to version 0.10.6 or later.

Database specific

{
    "cwe_ids":  [
        "CWE-94"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:36:57Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

npm / typed-function

Package

Name: typed-function; View open source insights on deps.dev
Purl: pkg:npm/typed-function

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.10.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-3qh4-r86r-grvm/GHSA-3qh4-r86r-grvm.json"