CVE-2022-25760

Arbitrary Code Injection

State: Published
Severity: 7.1 High
Published: Mar 17, 2022
Updated: Sep 16, 2024
Reserved: Feb 24, 2022

Description

All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If (attacker-controlled) user input is given to the format option of the package's exported constructor function, it is possible for an attacker to execute arbitrary JavaScript code on the host that this package is being run on.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L/E:P	snyk

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
accesslogn/a	before unspecifiedAffected

References

https://snyk.io/vuln/SNYK-JS-ACCESSLOG-2312099
https://github.com/carlos8f/node-accesslog/blob/master/lib/compile.js%23L6

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.