Executive brief
node-import is a Node.js library used to import and execute JavaScript code with synchronous support. The library passes user-controlled parameters directly to the JavaScript eval() function without any sanitization, allowing attackers to execute arbitrary code. This can lead to complete compromise of any application using this library.
Technical details
The vulnerability is a code injection flaw in the node-import library's module function. The `params` argument is passed directly to an eval() call (line 79 of index.js) without any sanitization or validation. An attacker can supply malicious JavaScript code as the params argument, which will be executed with the privileges of the Node.js process. The attack requires network access if the vulnerable library is exposed via an API, or local access if used in a command-line tool. The flaw affects all versions of the library up to and including 0.9.2. No patch has been identified in the available advisory information.
Affected products
- node-import node-import 0.9.2 and earlier
Timeline
- 2022-07-26: disclosed
- 2022-07-25: advisory: NVD publication date