Executive brief
pixl-class is a JavaScript library used for object-oriented programming patterns. The library failed to sanitize the members argument in its create function, allowing attackers to execute arbitrary operating system commands. This could enable complete system compromise, unauthorized data access, or malicious code execution on servers using affected versions of the library.
Technical details
pixl-class prior to version 1.0.3 is vulnerable to OS command injection via the create function's members argument. The vulnerability stems from use of eval() on unsanitized user input, allowing arbitrary code execution. The attack requires only network access with no authentication or user interaction, making it trivial to exploit remotely. An attacker can execute arbitrary system commands, potentially gaining full control of the affected system. The vulnerability was fixed in version 1.0.3 by removing reliance on eval().
Affected products
- pixl-class prior to 1.0.3
Timeline
- 2021-12-10: disclosed: Published to GitHub Advisory Database
- 2020: patched: Fixed in version 1.0.3