Vulnerability in Jsen Project
CVE-2020-7777
This affects all versions of package jsen. If an attacker can control the schema file, it could run arbitrary JavaScript code on the victim machine. In the module description and README file there is no mention about the risks of untrusted schema files, so I assume that this is applicable. In particular the required field of the schema is not properly sanitized. The resulting string that is build based on the schema definition is then passed to a Function.apply();, leading to an Arbitrary Code Execution.
EPSS: 0.020 (79.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Jsen_project Jsen
- N/a Jsen — versions 0
Public proof-of-concept exploits
References
- report@snyk.io (Exploit, Third Party Advisory, x_refsource_MISC)
- report@snyk.io (x_refsource_MISC, Broken Link)
Frequently asked questions
- What is CVE-2020-7777?
- CVE-2020-7777 is a high-severity vulnerability in Jsen Project. CVSS score: 7.2/10. Published 2020-11-23.
- How severe is CVE-2020-7777?
- High severity. CVSS v3 base score is 7.2 out of 10.
- Is CVE-2020-7777 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.