CVE-2020-7678

Arbitrary Code Execution

High · published July 25, 2022

CVSS v3.1
8.6
EPSS
1%
Percentile
66.9
In the wild
Unconfirmed
What it is

This affects all versions of package node-import. The "params" argument of module function can be controlled by users without any sanitization.b. This is then provided to the “eval” function located in line 79 in the index file "index.js".

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:U/RC:C
CVSS v4.0
Not supplied
EPSS
0.01160 · 66.9th percentile
Published
2022-07-25T14:07Z
EPSS history
Timeline
  • 25 JUL 14:07Z
    Arbitrary Code Execution
    cvelistv5