critical9.8
CVE-2020-7678
node-import `params` argument can be controlled by users without any sanitization
Impact
This affects all versions of package node-import. The `params` argument of module function can be controlled by users without any sanitization. This is then provided to the “eval” function located in line 79 in the index file `index.js`.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | node-import | <= 0.9.2 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Node-Import Project | Node-Import | All versions |