Description (CNA)
Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sanitization. Function generates a new function body and thus care must be given to ensure that the inputs to Function are not attacker-controlled. The risks involved are similar to that of allowing attacker-controlled input to reach eval.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / dom-iterator | affected 0 before 1.0.1 |
| n/a / org.webjars.npm:dom-iterator | affected 0 before * |
CWE
CWE-94
References
- https://security.snyk.io/vuln/SNYK-JS-DOMITERATOR-6157199
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8383166
- https://github.com/matthewmueller/dom-iterator/commit/9e0e0fad5a251de5b42feb326c4204eb04080805
ADP enrichment
No English description supplied.
No references supplied.