CVE-2022-25760
Last modified
CVE-2022-25760 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If (attacker-controlled) user input is given to the format option of the package's exported constructor function, it is possible for an attacker to execute arbitrary JavaScript code on the host that this package is being run on.. EPSS estimates a 1.61% chance of exploitation in the next 30 days.
Description
All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If (attacker-controlled) user input is given to the format option of the package's exported constructor function, it is possible for an attacker to execute arbitrary JavaScript code on the host that this package is being run on.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Accesslog Project | Accesslog | All versions |
References
- https://snyk.io/vuln/SNYK-JS-ACCESSLOG-2312099Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-ACCESSLOG-2312099Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-25760?
How severe is CVE-2022-25760?
How do I fix CVE-2022-25760?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-25755A vulnerability has been identified in SCALANCE X302-7 EEC (…7.5
- CVE-2022-25756A vulnerability has been identified in SCALANCE X302-7 EEC (…6.1
- CVE-2022-25757In Apache APISIX before 2.13.0, when decoding JSON with dupl…9.8
- CVE-2022-25758All versions of package scss-tokenizer are vulnerable to Reg…7.5
- CVE-2022-25759The package convert-svg-core before 0.6.2 are vulnerable to …9.8
- CVE-2022-2576In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.…7.5
- CVE-2022-25761The package open62541/open62541 before 1.2.5, from 1.3-rc1 a…7.5
- CVE-2022-25762If a web application sends a WebSocket message concurrently …8.6
- CVE-2022-25763Improper Input Validation vulnerability in HTTP/2 request va…7.5
- CVE-2022-25765The package pdfkit from 0.0.0 are vulnerable to Command Inje…9.8
- CVE-2022-25766The package ungit before 1.5.20 are vulnerable to Remote Cod…8.8
- CVE-2022-25767All versions of package com.bstek.ureport:ureport2-console a…9.8
Are you affected by CVE-2022-25760?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST