Executive brief
dom-iterator is a JavaScript library for iterating over DOM trees. Versions before 1.0.1 allow remote code execution when processing attacker-controlled input due to unsafe use of the Function constructor without proper sanitization. An attacker can inject arbitrary code that will execute in the context of any application using the vulnerable library.
Technical details
The vulnerability exists in the compile() method which uses the Function constructor to dynamically generate filter functions from user-supplied expressions. The Function constructor treats its string arguments as code, similar to eval(), creating an arbitrary code execution risk when inputs are not fully sanitized. Attack requires the attacker to control the expression string passed to the compile method; no authentication or user interaction is required in applications that process untrusted input. An attacker can inject JavaScript code that executes with the same privileges as the application. The fix (commit 9e0e0fa) adds Object.freeze() to prevent prototype pollution and further restricts the execution context.
Affected products
- npm dom-iterator <1.0.1
Timeline
- 2024-11-13: disclosed
- 2024-11-13: patched: Fixed in version 1.0.1 via commit 9e0e0fa