OS Command Injection

2020-03-1706:33:48

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

EPSS

0.004

Percentile

72.1%

JSON

node-rules is vulnerable to OS command injection. The argument rules in the fromJSON() in node-rules.js is passed to the eval function without any validation or sanitization, allowing an attacker to inject and execute arbitrary OS commands.

References

github.com/mithunsatheesh/node-rules/blob/4.0.2/lib/node-rules.js#L145-L161

github.com/mithunsatheesh/node-rules/commit/100862223904bb6478fcc33b701c7dee11f7b832

github.com/mithunsatheesh/node-rules/commit/100862223904bb6478fcc33b701c7dee11f7b832,

github.com/mithunsatheesh/node-rules/issues/84

EPSS

0.004

Percentile

72.1%

JSON

Related for VERACODE:22723