Description
node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution. User input provided to the argument `A` of `extend` function`(A,B,as,isAargs)` located within `lib/extend.js` is executed by the `eval` function, resulting in code execution.
Remediation
References
https://snyk.io/vuln/SNYK-JS-NODEEXTEND-571491
Related Vulnerabilities
CVE-2022-23496 Vulnerability in maven package nl.basjes.parse.useragent:yauaa-elastic-udfs-parent
CVE-2023-33246 Vulnerability in maven package org.apache.rocketmq:rocketmq-controller
CVE-2017-16171 Vulnerability in npm package hcbserver
CVE-2022-38179 Vulnerability in maven package io.ktor:ktor-utils
CVE-2022-41965 Vulnerability in maven package org.opencastproject:opencast-engage-paella-player