Critical · published August 15, 2022
🚨 A simple JSON string can unleash chaos! This vulnerability lets attackers execute arbitrary code through the dangerously convenient `eval` function in the `JsonFunctionValue` component. 🔥 Imagine a chef who blindly follows any recipe written on a napkin — if the napkin says to add toxic ingredients, that dish is going to be a disaster! In the same way, using `eval` in this library allows any string starting with 'function' to cook up code on your system without a second thought. This flaw opens the door for attackers to run any JavaScript code they want, potentially leading to data breaches, system compromise, or even complete control over the application. If left unaddressed, it could be absolutely devastating for users who unknowingly process untrusted JSON data.
Imagine a chef who blindly follows any recipe written on a napkin — if the napkin says to add toxic ingredients, that dish is going to be a disaster! In the same way, using `eval` in this library allows any string starting with 'function' to cook up code on your system without a second thought. The vulnerability arises from the `JsonFunctionValue` component using the `eval` function to execute strings as JavaScript functions. This allows malicious code hidden in JSON values to execute in the context of your application, bypassing normal security controls.
This flaw opens the door for attackers to run any JavaScript code they want, potentially leading to data breaches, system compromise, or even complete control over the application. If left unaddressed, it could be absolutely devastating for users who unknowingly process untrusted JSON data. Upgrade to version 2.2.2 or higher immediately to switch to the safer `Function` constructor. If you're on version 2.2.2, make sure to set the `allowFunctionEvaluation` prop to `false`. For versions 3.0.0 and above, you're already protected, as the prop defaults to `false`. You've got this! By following these steps, you can keep your application secure and prevent any unwelcome guests from crashing the party. 🛡️