Executive brief
cd-messenger is a Node.js console logging library used in development workflows. The library passes unsanitized user input directly to the eval() function when processing color arguments, allowing attackers to execute arbitrary code with the privileges of the application. This enables complete system compromise including data theft, malware installation, and operational disruption.
Technical details
This vulnerability is a code injection flaw (CWE-94) in the cd-messenger npm package through version 2.7.26. The vulnerability exists in the color argument handler, which executes user-supplied input via eval() without sanitization or validation. The attack vector is network-based with no authentication or user interaction required. An attacker can inject arbitrary JavaScript code through the color parameter, achieving remote code execution in the context of any application that uses cd-messenger. No patch is available; the vulnerability remains unresolved in this package.
Affected products
- npm cd-messenger through 2.7.26
Timeline
- 2020-06-05: disclosed
- 2021-05-17: advisory