CVE-2021-23406: Code Injection in pac-resolver
Summary
CVE-2021-23406: Code Injection in pac-resolver. Affects pac-resolver versions < 5.0.0. Fixed in 5.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pac-resolver package is an npm package used for handling PAC (Proxy Auto-Config) files. It provides functionality to resolve proxy configurations based on the provided PAC file. The package is widely used in applications that require proxy configuration. However, versions before 5.0.0 are vulnerable to a code injection vulnerability when used with untrusted input. This vulnerability is due to unsafe handling of PAC files, which can allow an attacker to inject malicious code.
Vulnerability Detail
The code injection vulnerability in pac-resolver (CVE-2021-23406) can be exploited when the package is used with untrusted input. An attacker can craft a malicious PAC file that contains code injection payloads. When the pac-resolver package processes this PAC file, the injected code can be executed in the context of the application, leading to various security risks. The impact of this vulnerability can range from unauthorized access to sensitive data to remote code execution. The vulnerability has a CVSS score of 8.1, indicating a high severity level.
How To Fix
Latest published version: 9.0.1 as of 23 Oct 2026
npm install pac-resolver@9.0.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.0.0
This is the first release that contains the fix.
npm install pac-resolver@5.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the pac-resolver package to the fixed version to mitigate the risk of code injection.
Conclusion
The code injection vulnerability in pac-resolver can lead to serious security risks, including unauthorized access and remote code execution. It is crucial to update the pac-resolver package to version 5.0.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pac-resolver →
FAQ
pac-resolver is an npm package used for handling PAC (Proxy Auto-Config) files. It provides functionality to resolve proxy configurations based on the provided PAC file.
The impact of this vulnerability can range from unauthorized access to sensitive data to remote code execution.
To fix this vulnerability, update the pac-resolver package to version 5.0.0 or later.
There is no known workaround for this vulnerability. Updating the pac-resolver package is the recommended solution.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
