CVE-2014-7192 Potential for Script Injection in syntax-error
HighCVSS 10.0
EPSS 13.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows remote attackers to execute arbitrary code via a crafted file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm syntax-error(npm) | < 1.1.1 | 1.1.1 |
| joyent node.js | <= 0.10.32 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com
- www.npmjs.com
- github.com exploit patch
- nodejs-cve20147192-code-exec(96728) vdb-entry
- www-01.ibm.com
- github.com
- nodesecurity.io vendor-advisory