CRITICAL9.8

GHSA-f78f-353m-cf4j

Code Injection in node-rules

Quick fix

GHSA-f78f-353m-cf4j — node-rules: upgrade to the fixed version with the command below.

npm install node-rules@5.0.0

Details

node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function "fromJSON()" can be controlled by users without any sanitization.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/node-rules

Introduced in: 3.0.0Fixed in: 5.0.0

Fixnpm install node-rules@5.0.0

References

https://nvd.nist.gov/vuln/detail/CVE-2020-7609[ADVISORY]
https://github.com/mithunsatheesh/node-rules/issues/84[WEB]
https://github.com/mithunsatheesh/node-rules/commit/100862223904bb6478fcc33b701c7dee11f7b832[WEB]
https://snyk.io/vuln/SNYK-JS-NODERULES-560426[WEB]