Vulnerability · Published Jun 3, 2022 · Assigned by snyk
CVE-2022-21122Arbitrary Code Execution
Critical 9.0
In plain English
A critical-severity security flaw in metacalc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.0Critical
Exploit odds (30 days)2.7%top 14.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | metacalc | 0.0.2 | GHSA-5gc4-cx9x-9c43 |
Affected products (as reported)
References
- https://snyk.io/vuln/SNYK-JS-METACALC-2826197 x_refsource_MISC
- https://github.com/metarhia/metacalc/pull/16 x_refsource_MISC
- https://github.com/metarhia/metacalc/commit/625c23d63eabfa16fc815f5832b147b08d2144bd x_refsource_MISC