Executive brief
node-extend is a JavaScript library used to merge or extend objects in Node.js applications. A code injection vulnerability allows attackers to execute arbitrary JavaScript code when untrusted user input is passed to the extend function, potentially compromising application security, data integrity, and operations.
Technical details
The vulnerability is a code injection flaw (CWE-94) in the extend function within lib/extend.js. User-controlled input passed to argument A of the extend(A, B, as, isAargs) function is directly passed to JavaScript's eval() function, allowing arbitrary code execution. The attack requires no authentication or user interaction and is network-reachable if the vulnerable function processes untrusted input from external sources. An attacker can achieve complete system compromise including code execution, data theft, and denial of service. No patched version of node-extend exists; the vulnerability affects all versions through 0.2.0.
Affected products
- node-extend node-extend through 0.2.0
Timeline
- 2020-06-05: disclosed
- 2021-05-17: advisory