CVE-2022-21122

Katalog CVE

CVSS 9.8 · Critical EPSS 2,5%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada metarhia metacalc. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor.

Rincian

Terbit di NVD

8 Juni 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

2,5% peluang dieksploitasi; lebih tinggi dari 84,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/metarhia/metacalc/commit/625c23d63eabfa16fc815f5832b147b08d2144bd patch · advisory pihak ketiga
• https://github.com/metarhia/metacalc/pull/16 patch · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-METACALC-2826197 exploit · advisory pihak ketiga