CVE-2022-21122 Arbitrary Code Execution

The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor...

CVE-2022-21122

CVE-2022-21122 affects metacalc prior to 0.0.2. The root cause is exposure of JavaScript Math to the v8 context, which allows access to Function constructor and arbitrary code execution. Documented in multiple sources (Snyk, GHSA, Veracode, OSV/NVD mirrors). Impact is arbitrary code execution thr...