CVE-2022-21122
Last modified
CVE-2022-21122 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor.. EPSS estimates a 2.39% chance of exploitation in the next 30 days.
Description
The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Metarhia | Metacalc | < 0.0.2 |
References
- https://github.com/metarhia/metacalc/commit/625c23d63eabfa16fc815f5832b147b08d2144bdPatch, Third Party Advisory
- https://github.com/metarhia/metacalc/pull/16Patch, Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-METACALC-2826197Exploit, Third Party Advisory
- https://github.com/metarhia/metacalc/commit/625c23d63eabfa16fc815f5832b147b08d2144bdPatch, Third Party Advisory
- https://github.com/metarhia/metacalc/pull/16Patch, Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-METACALC-2826197Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-21122?
How severe is CVE-2022-21122?
How do I fix CVE-2022-21122?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-2105Client-side JavaScript controls may be bypassed to change us…9.1
- CVE-2022-2106Elcomplus SmartICS v2.3.4.0 does not validate the filenames …2.7
- CVE-2022-2107The MiCODUS MV720 GPS tracker API server has an authenticati…9.8
- CVE-2022-2108The plugin Wbcom Designs – BuddyPress Group Reviews for Word…5.3
- CVE-2022-2111Unrestricted Upload of File with Dangerous Type in GitHub re…8.8
- CVE-2022-2112Improper Neutralization of Formula Elements in a CSV File in…8.8
- CVE-2022-21123Incomplete cleanup of multi-core shared buffers for some Int…5.5
- CVE-2022-21124Out-of-bounds write vulnerability in CX-Programmer v9.76.1 a…7.8
- CVE-2022-21125Incomplete cleanup of microarchitectural fill buffers on som…5.5
- CVE-2022-21126The package com.github.samtools:htsjdk before 3.0.1 are vuln…7.8
- CVE-2022-21127Incomplete cleanup in specific special register read operati…5.5
- CVE-2022-21128Insufficient control flow management in the Intel(R) Advisor…7.8
Are you affected by CVE-2022-21122?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST