Fiche vulnérabilité
CVE-2022-25760 : faille critique accesslog project accesslog (CVSS 9.8)
Description
All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If (attacker-controlled) user input is given to the format option of the package's exported constructor function, it is possible for an attacker to execute arbitrary JavaScript code on the host that this package is being run on.
En bref
- Sévérité
- Critique (CVSS 9.8)
- Vecteur CVSS
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Exploitation active
- Non signalée par la CISA
- Publication
- 17 mars 2022
- Dernière mise à jour
- 17 juin 2026
Produits concernés
- accesslog project accesslog