Open-source package vulnerability · npm

GHSA-q849-wxrc-vqrp: hull.js Code Injection Vulnerability

critical

Versions of the library from 0.2.2 to 1.0.9 are vulnerable to the arbitrary code execution due to unsafe usage of new Function(...) in the module that handles points format. Applications passing the 3rd parameter to the hull function without sanitising may be impacted. The vulnerability has been fixed in version 1.0.10, please update the library.

Published Dec 2, 2024

Affected packages

hull.js

Ecosystem: npm
Affected: >= 0.2.2, < 1.0.10
Fixed in: 1.0.10
Check: npm ls hull.js

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Versions of the library from 0.2.2 to 1.0.9 are vulnerable to the arbitrary code execution due to unsafe usage of new Function(...) in the module that handles points format. Applications passing the 3rd parameter to the hull function without sanitising may be impacted. The vulnerability has been fixed in version 1.0.10, please update the library. Check project homepage on GitHub to see how to fetch the latest version: https://github.com/andriiheonia/hull?tab=readme-ov-file#npm-package

Credited to mcoimbra, filipeom.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology