Executive brief
The reduce-css-calc library is an npm package used to simplify CSS calc() expressions in web applications. Because it uses eval() to process user input without proper validation, attackers can inject and execute arbitrary code, leading to complete system compromise on the server or XSS attacks in the browser. This allows unauthorized file access, data theft, and malicious script execution.
Technical details
The vulnerability is a code injection flaw (CWE-94) in reduce-css-calc versions prior to 1.2.5. The library evaluates CSS calc() expressions by passing unsanitized input directly to JavaScript's eval() function. An attacker can craft malicious calc() expressions containing arbitrary JavaScript code—such as require('fs').readFileSync() calls to read files or Buffer allocation to cause denial of service. The attack requires only the ability to supply input to the calc() function; no authentication is needed. On servers, this enables remote code execution; in browsers, it enables cross-site scripting (XSS). The fix is available in version 1.2.5 and later, which implements proper input validation and avoids eval().
Affected products
- npm reduce-css-calc < 1.2.5
Timeline
- 2016-08-20: disclosed: Vulnerability first disclosed in GitHub gist
- 2018-06-07: advisory: GHSA-4662-j96g-mv46 published to GitHub Advisory Database
- 2016: patched: Fix available in version 1.2.5 or later