CVE-2020-7672: Code Injection in mosc
Summary
CVE-2020-7672: Code Injection in mosc. Affects mosc versions < 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mosc is an npm package that provides functionality for executing code. It is vulnerable to Arbitrary Code Execution due to a flaw in the eval function. When user input is provided to the properties argument, it is executed without proper validation, allowing an attacker to inject and execute arbitrary code.
Vulnerability Detail
The vulnerability in mosc allows an attacker to execute arbitrary code by manipulating the properties argument. This can lead to various security risks, including remote code execution, data breaches, and unauthorized access to sensitive information. The vulnerability has a CVSS score of 8.6, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the latest version of mosc to mitigate the risk of code injection.
Conclusion
The vulnerability in mosc allows for arbitrary code execution, posing significant security risks. It is crucial to update to the latest version of mosc (1.0.1 or later) to mitigate the vulnerability. For further support and guidance on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for mosc →
FAQ
The vulnerability allows an attacker to execute arbitrary code, potentially leading to remote code execution, data breaches, and unauthorized access to sensitive information.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. It analyzes your package-lock.json file and provides real-time alerts for open-source vulnerabilities.
Yes, the vulnerability can be fixed by updating mosc to version 1.0.1 or later. Make sure to run npm install mosc@latest to update the package.
There are no known workarounds for this vulnerability. It is essential to update to the latest version of mosc to mitigate the risk.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing the vulnerability.
