Vulnerability · Published Jun 10, 2020 · Assigned by snyk

CVE-2020-7673

Critical 9.8

In plain English

A critical-severity security flaw in node-extend. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 85% of all known vulnerabilities).

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)2.6%top 14.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution. User input provided to the argument `A` of `extend` function`(A,B,as,isAargs)` located within `lib/extend.js` is executed by the `eval` function, resulting in code execution.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	node-extend	no fix listed	GHSA-cg42-4wrc-gp47

Affected products (as reported)

Vendor	Product	Versions
n/a	node-extend	All versions including 0.2.0

References

https://snyk.io/vuln/SNYK-JS-NODEEXTEND-571491 x_refsource_MISC