Executive brief
hull.js is a JavaScript library for computing concave hulls from a set of geometric points. The library contains a code injection vulnerability in how it processes the points format parameter, allowing attackers to execute arbitrary code if an application passes unsanitized input to the hull function's third parameter.
Technical details
The vulnerability stems from unsafe usage of the JavaScript Function constructor (`new Function(...)`) in the module that handles points format conversion. An attacker can inject arbitrary code by crafting malicious input for the third parameter passed to the hull function without proper sanitization. The attack requires the application to pass untrusted user input directly to the vulnerable parameter. The vulnerability affects versions 0.2.2 through 1.0.9 and has been patched in version 1.0.10.
Affected products
- AndriiHeonia hull.js 0.2.2 to 1.0.9
Timeline
- 2024-11-30: disclosed
- 2024-11-06: patched: Version 1.0.10 released with security improvements