CVE-2022-36010
🗓️ 15 Aug 2022 18:30:14Reported by GitHub_MType 
cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 102 Views🌐 WEB
| Reporter | Title | Published | Views | Family All 14 |
|---|---|---|---|---|
 | CVE-2022-36010 | 15 Aug 202222:38 | – | circl |
 | React Editable Json Tree 安全漏洞 | 15 Aug 202200:00 | – | cnnvd |
 | CVE-2022-36010 Arbitrary code execution via function parsing in react-editable-json-tree | 15 Aug 202218:30 | – | cvelist |
 | EUVD-2022-6574 | 3 Oct 202520:07 | – | euvd |
 | React Editable Json Tree vulnerable to arbitrary code execution via function parsing | 18 Aug 202219:15 | – | github |
 | CVE-2022-36010 | 15 Aug 202218:30 | – | mend |
 | CVE-2022-36010 | 15 Aug 202219:15 | – | nvd |
 | GHSA-J3RV-W43Q-F9X2 React Editable Json Tree vulnerable to arbitrary code execution via function parsing | 18 Aug 202219:15 | – | osv |
 | Code injection | 15 Aug 202219:15 | – | prion |
 | PT-2022-23110 · Unknown · React-Editable-Json-Tree | 15 Aug 202200:00 | – | ptsecurity |
10
Node
[
{
"product": "react-editable-json-tree",
"vendor": "oxyno-zeta",
"versions": [
{
"status": "affected",
"version": "< 2.2.2"
}
]
}
]| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| JSON value starting with 'function' | nested | github.com/oxyno-zeta/react-editable-json-tree/blob/09a0ca97835b0834ad054563e2fddc6f22bc5d8c/src/components/JsonFunctionValue.js | Vulnerability occurs when strings in JSON are parsed as functions and evaluated via Function/parse.js when allowFunctionEvaluation is enabled, enabling arbitrary code execution. | CWE-95 |
| JSON value starting with 'function' | nested | github.com/oxyno-zeta/react-editable-json-tree/blob/master/src/utils/parse.js#L30 | parse.js constructs functions from strings (via Function) and is invoked by the default onSubmitValueParser, enabling execution of function-like strings in untrusted data. | CWE-95 |
| onSubmitValueParser | path | github.com/oxyno-zeta/react-editable-json-tree/tree/09a0ca97835b0834ad054563e2fddc6f22bc5d8c#onsubmitvalueparser | The default onSubmitValueParser delegates to parse.js; if allowFunctionEvaluation is true, submitted values containing function-like strings can be executed. | CWE-95 |
| allowFunctionEvaluation | path | github.com/oxyno-zeta/react-editable-json-tree/tree/09a0ca97835b0834ad054563e2fddc6f22bc5d8c#onsubmitvalueparser | The default onSubmitValueParser delegates to parse.js; if allowFunctionEvaluation is true, submitted values containing function-like strings can be executed. | CWE-95 |
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
17 Jun 2026 04:52Current
8.4High risk
Vulners AI Score8.4
CVSS 3.19.8 - 10
EPSS0.01487
SSVC