Unscored severity · published Dec 11, 2014
CVE-2014-7192
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows…
–
CVSS
13%
EPSS
No
On KEV
Description
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows remote attackers to execute arbitrary code via a crafted file.
Exploitation
Is it being used?
Exploit prediction (EPSS)13.0% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
Node.js · Joyent
through 0.10.32 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-7192
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-7192
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg21690815
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/96728
Exploit
https://github.com/substack/node-syntax-error/commit/9aa4e66eb90ec595d2dba55e6f9c2dd9a668b309
Vendor Advisory
https://nodesecurity.io/advisories/syntax-error-potential-script-injection
More from Node.js
–
CVE-2014-6394
visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access…