Description
access-policy through 3.1.0 is vulnerable to Arbitrary Code Execution. User input provided to the `template` function is executed by the `eval` function resulting in code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | access-policy | All versions including 3.1.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | access-policy | <= 3.1.0 | — | GHSA-fw2f-7f87-5r6c |