What is CVE-2022-36010?

CVE-2022-36010 is a critical-severity vulnerability in Oxyno-zeta React-editable-json-tree, classified under Eval Injection. CVSS score: 10.0/10. Published 2022-08-15.

How severe is CVE-2022-36010?

Critical severity. CVSS v3 base score is 10.0 out of 10.

RCE in Oxyno-zeta React-editable-json-tree

CVE-2022-36010

This library allows strings to be parsed as functions and stored as a specialized component, [`JsonFunctionValue`](https://github.com/oxyno-zeta/react-editable-json-tree/blob/09a0ca97835b0834ad054563e2fddc6f22bc5d8c/src/components/JsonFunc…

EPSS: 0.012 (64.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Oxyno-zeta React-editable-json-tree — versions < 2.2.2
React_editable_json_tree_project React_editable_json_tree

Weakness classification (CWE)

CWE-95 — Eval Injection

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Third Party Advisory)
security-advisories@github.com (Third Party Advisory, x_refsource_MISC, Release Notes)

Frequently asked questions

What is CVE-2022-36010?: CVE-2022-36010 is a critical-severity vulnerability in Oxyno-zeta React-editable-json-tree, classified under Eval Injection. CVSS score: 10.0/10. Published 2022-08-15.
How severe is CVE-2022-36010?: Critical severity. CVSS v3 base score is 10.0 out of 10.