VulnerabilityModified
CVE-2014-7192
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows remote attackers to execute arbitrary code via a crafted file.
HIGH 10.0EPSS 13.0%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 13.0%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows remote attackers to execute arbitrary code via a crafted file.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 13.05% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- joyent/node.js
- Source
- cve@mitre.org
References
- http://www-01.ibm.com/support/docview.wss?uid=swg21690815
- https://exchange.xforce.ibmcloud.com/vulnerabilities/96728
- https://github.com/substack/node-syntax-error/commit/9aa4e66eb90ec595d2dba55e6f9c2dd9a668b309Exploit
- https://nodesecurity.io/advisories/syntax-error-potential-script-injectionVendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21690815
- https://exchange.xforce.ibmcloud.com/vulnerabilities/96728
- https://github.com/substack/node-syntax-error/commit/9aa4e66eb90ec595d2dba55e6f9c2dd9a668b309Exploit
- https://nodesecurity.io/advisories/syntax-error-potential-script-injectionVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.