logo

Database

Server side template injection In typed-function

Description

Arbitrary JavaScript Execution in typed-function Versions of typed-function prior to 0.10.6 are vulnerable to Arbitrary JavaScript Execution. Function names are not properly sanitized and may allow an attacker to execute arbitrary code.

Recommendation

Upgrade to version 0.10.6 or later.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2017-10010042. NVD-2017-10010043. OSV-2017-10010044. GCVE-2017-1001004

References

1. https://github.com/josdejong/typed-function/commit/6478ef4f2c3f3c2d9f2c820e2db4b4ba3425e6fe2. https://github.com/josdejong/typed-function/commit/6478ef4f2c3f3c2d9f2c820e2db4b4ba3425e6fe?diff=split#diff-9e1f22c2954a38db1fdf444dbc74e0a83. https://github.com/josdejong/typed-function/blob/master/HISTORY.md#2017-11-18-version-01064. https://www.npmjs.com/advisories/819

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.