PT-2020-19652

Name of the Vulnerable Software and Affected Versions node-rules versions 3.0.0 through 5.0.0 Description The issue allows for the injection of arbitrary commands. This is possible because the argument rules of the function fromJSON can be controlled by users without any sanitization, enabling...

OS Command Injection

node-rules is vulnerable to OS command injection. The argument rules in the fromJSON in node-rules.js is passed to the eval function without any validation or sanitization, allowing an attacker to inject and execute arbitrary OS commands...

Arbitrary Code Execution

Overview node-rules is a light weight forward chaining Rule Engine, written in JavaScript. Affected versions of this package are vulnerable to Arbitrary Code Execution. The injection point is located in line 152,153. The argument rules of function fromJSON can be controlled by users without any...