CVE-2020-7609

Katalog CVE

CVSS 9.8 · Critical EPSS 1,6%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada node-rules project node-rules. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function "fromJSON()" can be controlled by users without any sanitization.

Rincian

Terbit di NVD

27 April 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://snyk.io/vuln/SNYK-JS-NODERULES-560426 exploit · patch · advisory pihak ketiga
• https://github.com/mithunsatheesh/node-rules/commit/100862223904bb6478fcc33b701c7dee11f7b832 patch · advisory pihak ketiga
• https://github.com/mithunsatheesh/node-rules/commit/100862223904bb6478fcc33b701c7dee11f7b832%2C