Description
node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function "fromJSON()" can be controlled by users without any sanitization.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | node-rules | All versions including 3.0.0 and prior to 5.0.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | node-rules | >= 3.0.0, < 5.0.0 | 5.0.0 | GHSA-f78f-353m-cf4j |