CVE-2020-7697

This affects all versions of package mock2easy. a malicious user could inject commands through the data variable: Affected Area require'../server/getJsonByCurl'mock2easy, function error, stdout if error return res.json500, error; res.jsonJSON.parsestdout; , '', data.interfaceUrl, query,...

CVE-2020-7697

The CVE-2020-7697 entry concerns the npm package mock2easy, with a code injection vulnerability exposed via the _data variable in the command path that invokes a server-side curl wrapper. Technical details in connected items show the vulnerable call pattern: require('../server/getJsonByCurl')(moc...

CVE-2020-7697 Command Injection

This affects all versions of package mock2easy. a malicious user could inject commands through the data variable: Affected Area require'../server/getJsonByCurl'mock2easy, function error, stdout if error return res.json500, error; res.jsonJSON.parsestdout; , '', data.interfaceUrl, query,...