Executive brief
module-from-string is a Node.js library that dynamically loads and executes code from strings. A prototype pollution vulnerability allows attackers to inject malicious properties into the global object prototype by supplying crafted payloads, causing application crashes (denial of service) or potentially enabling arbitrary code execution if polluted properties propagate to sensitive APIs.
Technical details
The vulnerability is a prototype pollution flaw in the lib.requireFromString function of module-from-string v3.3.1 (CWE-1321). The function does not properly validate or sanitize input containing prototype chain references (e.g., "__proto__"), allowing attackers to inject arbitrary properties into Object.prototype. Attack vector is network-based if the library processes untrusted input (e.g., from an API or user-supplied code string). The minimum impact is denial of service through object corruption; escalation to remote code execution is possible if polluted properties propagate to dangerous APIs like exec() or eval(). Patches or updates to remediate this vulnerability should be available from the maintainer.
Affected products
- exuanbo module-from-string 0 to 3.3.1
Timeline
- 2025-02-05: disclosed: NVD published
- 2025-02-06: advisory: GitHub advisory GHSA-q5j8-9m9g-x2jh published