CVE-2022-21122

Arbitrary Code Execution

State: Published
Severity: 9.0 Critical
Published: Jun 3, 2022
Updated: Sep 16, 2024
Reserved: Feb 24, 2022

Description

The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor.

Scores

CVSS	Score	Vector	Source
3.1	9.0 Critical	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P	snyk

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
metacalcn/a	before 0.0.2Affected

References

https://snyk.io/vuln/SNYK-JS-METACALC-2826197
https://github.com/metarhia/metacalc/pull/16
https://github.com/metarhia/metacalc/commit/625c23d63eabfa16fc815f5832b147b08d2144bd

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.