Description
Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sanitization. Function generates a new function body and thus care must be given to ensure that the inputs to Function are not attacker-controlled. The risks involved are similar to that of allowing attacker-controlled input to reach eval.
Published: 2024-11-13
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-3277 Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sanitization. Function generates a new function body and thus care must be given to ensure that the inputs to Function are not attacker-controlled. The risks involved are similar to that of allowing attacker-controlled input to reach eval.
Github GHSA Github GHSA GHSA-jrvm-mcxc-mf6m dom-iterator code execution vulnerability
History

Tue, 14 Jan 2025 17:00:00 +0000

Type Values Removed Values Added
Description All versions of the package dom-iterator are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sanitization. Function generates a new function body and thus care must be given to ensure that the inputs to Function are not attacker-controlled. The risks involved are similar to that of allowing attacker-controlled input to reach eval. Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sanitization. Function generates a new function body and thus care must be given to ensure that the inputs to Function are not attacker-controlled. The risks involved are similar to that of allowing attacker-controlled input to reach eval.
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Tue, 19 Nov 2024 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Matthewmueller
Matthewmueller dom-iterator
CPEs cpe:2.3:a:matthewmueller:dom-iterator:*:*:*:*:*:node.js:*:*
Vendors & Products Matthewmueller
Matthewmueller dom-iterator

Thu, 14 Nov 2024 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Dom-iterator
Dom-iterator dom-iterator
CPEs cpe:2.3:a:dom-iterator:dom-iterator:*:*:*:*:*:*:*:*
Vendors & Products Dom-iterator
Dom-iterator dom-iterator
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 13 Nov 2024 05:15:00 +0000

Type Values Removed Values Added
Description All versions of the package dom-iterator are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sanitization. Function generates a new function body and thus care must be given to ensure that the inputs to Function are not attacker-controlled. The risks involved are similar to that of allowing attacker-controlled input to reach eval.
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P'}

Subscriptions

Dom-iterator Dom-iterator
Matthewmueller Dom-iterator
cve-icon MITRE

Status: PUBLISHED

Assigner: snyk

Published:

Updated: 2025-01-16T11:24:30.637Z

Reserved: 2023-12-22T12:33:20.123Z

Link: CVE-2024-21541

cve-icon Vulnrichment

Updated: 2024-11-14T16:04:20.796Z

cve-icon NVD

Status : Modified

Published: 2024-11-13T05:15:14.680

Modified: 2026-04-29T01:00:01.613

Link: CVE-2024-21541

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses