Security Advisory

CVE-2022-25760

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2022-03-17 11:20:27

Last updated 2024-09-16 23:50:32

Assigner snyk

State PUBLISHED

Description

All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If (attacker-controlled) user input is given to the format option of the packages exported constructor function, it is possible for an attacker to execute arbitrary JavaScript code on the host that this package is being run on.

← Browse all CVEs View on cve.org ↗