CVE-2020-7678

Arbitrary Code Execution

This affects all versions of package node-import. The "params" argument of module function can be controlled by users without any sanitization.b. This is then provided to the “eval” function located in line 79 in the index file "index.js".

Affected

node-import

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 SNYK

8.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

EPSS

1.16% chance of exploitation in the next 30 days, 67th percentile

Published

2022-07-25

Updated

2024-09-17

Proof-of-concept exploits (1)

• https://security.snyk.io/vuln/SNYK-JS-NODEIMPORT-571691

Security advisories

• mahdaen/node-import/blob/master/index.js%23L79
• advisories/GHSA-pc62-cq5x-3j5g

References

• CVE Record
• NVD entry