CVE-2016-10548 Arbitrary Code Injection in reduce-css-calc
MediumCVSS 6.1
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Arbitrary code execution is possible in reduce-css-calc node module <=1.2.4 through crafted css. This makes cross sites scripting (XSS) possible on the client and arbitrary code injection possible on the server and user input is passed to the calc function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm reduce-css-calc(npm) | < 1.2.5 | 1.2.5 |
| reduce-css-calc project reduce-css-calc | <= 1.2.4 | No fix listed |
| HackerOne reduce-css-calc node module | = <=1.2.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- gist.github.com exploit third-party-advisory
- github.com
- www.npmjs.com
- nodesecurity.io exploit third-party-advisory