CVE-2022-25760

Katalog CVE

CVSS 9.8 · Critical EPSS 1,6%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada accesslog project accesslog. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If (attacker-controlled) user input is given to the format option of the package's exported constructor function, it is possible for an attacker to execute arbitrary JavaScript code on the host that this package is being run on.

Rincian

Terbit di NVD

17 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://snyk.io/vuln/SNYK-JS-ACCESSLOG-2312099 exploit · advisory pihak ketiga
• https://github.com/carlos8f/node-accesslog/blob/master/lib/compile.js%23L6 broken link