CVE-2016-10548

State: Published
Severity: Not scored
Published: May 31, 2018
Updated: Sep 16, 2024
Reserved: Oct 29, 2017

Description

Arbitrary code execution is possible in reduce-css-calc node module <=1.2.4 through crafted css. This makes cross sites scripting (XSS) possible on the client and arbitrary code injection possible on the server and user input is passed to the `calc` function.

Scores

The record has no CVSS score.

Weaknesses

CWE-94 Code Injection (CWE-94)

Affected Products

Product	Versions
reduce-css-calc node moduleHackerOne	<=1.2.4Affected

References

https://gist.github.com/ChALkeR/415a41b561ebea9b341efbb40b802fc9
https://nodesecurity.io/advisories/144

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.