CVE-2016-10548: Arbitrary Code Injection in reduce-css-calc
Summary
CVE-2016-10548: Arbitrary Code Injection in reduce-css-calc. Affects reduce-css-calc versions < 1.2.5. Fixed in 1.2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
reduce-css-calc is an npm package that provides functionality for reducing CSS calc expressions. It is commonly used in web development to optimize and simplify CSS calculations. However, versions of reduce-css-calc prior to 1.2.5 are vulnerable to arbitrary code injection. This vulnerability arises from the package passing user input directly to the eval function. If user input is passed into the calc function, it can lead to cross-site scripting (XSS) attacks on the browser or remote code execution on the server.
Vulnerability Detail
The vulnerability in reduce-css-calc allows an attacker to inject arbitrary code into the application. By manipulating the input passed to the calc function, an attacker can execute malicious code on the server or inject scripts that will be executed by the browser. This can lead to various security risks, including unauthorized access to sensitive data, remote code execution, and the ability to perform actions on behalf of the user.
How To Fix
Minimum fixed version
1.2.5
This is the first release that contains the fix.
npm install reduce-css-calc@1.2.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to sanitize and validate user input before passing it to the calc function. By implementing proper input validation and sanitization measures, the risk of code injection can be reduced. However, this is not a foolproof solution and updating to the latest version of reduce-css-calc is still recommended.
Conclusion
The vulnerability in reduce-css-calc can lead to arbitrary code injection, posing significant security risks. It is crucial to update the package to the latest version or implement proper input validation and sanitization measures. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for reduce-css-calc →
FAQ
reduce-css-calc is an npm package used for reducing CSS calc expressions in web development.
The vulnerability allows an attacker to inject arbitrary code, potentially leading to XSS attacks or remote code execution.
Update reduce-css-calc to version 1.2.5 or later to fix the vulnerability.
A temporary workaround is to sanitize and validate user input before passing it to the calc function.
There are known proof-of-concept exploits that demonstrate the potential impact of this vulnerability.
