GHSA-f78f-353m-cf4j

    Dashboard / Vulnerabilities / GHSA-f78f-353m-cf4j

    GHSA-f78f-353m-cf4j

    Published: 10 Dec 2021Last Modified: 8 Jul 2026

    Summary: Code Injection in node-rules

    Details: node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function "fromJSON()" can be controlled by users without any sanitization.

    References: https://nvd.nist.gov/vuln/detail/CVE-2020-7609, https://github.com/mithunsatheesh/node-rules/issues/84, https://github.com/mithunsatheesh/node-rules/commit/100862223904bb6478fcc33b701c7dee11f7b832, https://snyk.io/vuln/SNYK-JS-NODERULES-560426

    Affected packages

    Package

    Name: node-rules

    Purl: pkg:npm/node-rules

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 3.0.0
    Fixed -5.0.0

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-f78f-353m-cf4j | CVE-DB