Unsafe use of eval()

Affecting summit package, versions >=0.1.0

medium severity

Overview

summit is a node web framework.

Affected versions of this package are vulnerable to Arbitrary Command Execution via the eval() function in the PouchDB driver. Node.js provides the eval() function by default, and is used to translate strings into Javascript code. An attacker can craft a malicious payload instead of a valid collection name to inject arbitrary commands.

Remediation

There is no fix version for summit.

References

Credit
Cristian-Alexandru Staicu, Michael Pradel, Ben Livshits
CWE
CWE-94
Snyk ID
npm:summit:20160408
Disclosed
08 Apr, 2016
Published
16 Apr, 2017

Do your applications use this vulnerable package?