CVE-2024-21541

View on CVE.org
Published Nov 13, 2024 CVSS 4.0 · 6.9 Medium EPSS 1.1% KEV · Not listed
Description
Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sanitization. Function generates a new function body and thus care must be given to ensure that the inputs to Function are not attacker-controlled. The risks involved are similar to that of allowing attacker-controlled input to reach eval.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2024-3277 Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sanitization. Function generates a new function body and thus care must be given to ensure that the inputs to Function are not attacker-controlled. The risks involved are similar to that of allowing attacker-controlled input to reach eval.
Github GHSA Github GHSA GHSA-jrvm-mcxc-mf6m dom-iterator code execution vulnerability
History
Type Values Removed Values Added
Description All versions of the package dom-iterator are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sanitization. Function generates a new function body and thus care must be given to ensure that the inputs to Function are not attacker-controlled. The risks involved are similar to that of allowing attacker-controlled input to reach eval. Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sanitization. Function generates a new function body and thus care must be given to ensure that the inputs to Function are not attacker-controlled. The risks involved are similar to that of allowing attacker-controlled input to reach eval.
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Type Values Removed Values Added
First Time appeared Matthewmueller
Matthewmueller dom-iterator
CPEs cpe:2.3:a:matthewmueller:dom-iterator:*:*:*:*:*:node.js:*:*
Vendors & Products Matthewmueller
Matthewmueller dom-iterator
Type Values Removed Values Added
First Time appeared Dom-iterator
Dom-iterator dom-iterator
CPEs cpe:2.3:a:dom-iterator:dom-iterator:*:*:*:*:*:*:*:*
Vendors & Products Dom-iterator
Dom-iterator dom-iterator
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description All versions of the package dom-iterator are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sanitization. Function generates a new function body and thus care must be given to ensure that the inputs to Function are not attacker-controlled. The risks involved are similar to that of allowing attacker-controlled input to reach eval.
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
snyk
Published
Updated
Jan 16, 2025, 11:24 AM
Reserved
Dec 22, 2023, 12:33 PM

View source JSON

Updated
Nov 14, 2024, 4:04 PM

JSON

Status
Modified
Published
Nov 13, 2024, 5:15 AM
Modified
Jun 17, 2026, 7:09 AM

View source JSON

No data.

No data.