Command Injection in node-rules
Summary
GHSA-8whr-v3gm-w8h9: Command Injection in node-rules. Affects node-rules versions < 5.0.0. Fixed in 5.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-rules package is an npm package used for creating and managing rules in Node.js applications. It provides a way to define and execute rules using a JSON-based syntax. The package is commonly used in applications that require dynamic rule evaluation. However, versions prior to 5.0.0 are vulnerable to Command Injection.
Vulnerability Detail
The vulnerability in node-rules arises from the package's failure to properly sanitize input rules. When using the fromJSON function, the package directly passes the input rules to an eval call without proper validation. This allows an attacker to inject arbitrary code into the system if the rules are controlled by the user. The impact of this vulnerability can be severe, as it enables remote code execution and unauthorized access to the system.
How To Fix
Latest published version: 9.2.0 as of 23 Oct 2026
npm install node-rules@9.2.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.0.0
This is the first release that contains the fix.
npm install node-rules@5.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The best course of action is to upgrade to the latest version of the node-rules package as mentioned in the 'how_to_fix' section.
Conclusion
The node-rules package prior to version 5.0.0 is vulnerable to command injection, which can lead to remote code execution and unauthorized access. It is crucial to upgrade to version 5.0.0 or later to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for node-rules →
FAQ
The vulnerability allows an attacker to execute arbitrary code on the system, potentially leading to remote code execution and unauthorized access.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using package-lock.json.
No, only versions prior to 5.0.0 are affected. Upgrading to version 5.0.0 or later will fix the vulnerability.
There is no known exploit available for this vulnerability at the moment. However, it is crucial to patch the vulnerability as soon as possible to prevent any potential attacks.
No, the recommended solution is to upgrade to the latest version of the node-rules package. This ensures that the vulnerability is properly patched and the application is secure.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-rules.
