Description
This affects all versions of package node-import. The "params" argument of module function can be controlled by users without any sanitization.b. This is then provided to the “eval” function located in line 79 in the index file "index.js".
Remediation
References
https://github.com/mahdaen/node-import/blob/master/index.js%23L79
https://security.snyk.io/vuln/SNYK-JS-NODEIMPORT-571691
Related Vulnerabilities
CVE-2019-12086 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2020-6454 Vulnerability in npm package electron
CVE-2019-10249 Vulnerability in maven package org.eclipse.xtext:org.eclipse.xtext.maven.parent
CVE-2020-7760 Vulnerability in maven package org.apache.marmotta.webjars:codemirror
CVE-2020-2262 Vulnerability in maven package org.jenkins-ci.plugins:android-lint