CVE-2020-7678: node-import `params` argument can be controlled by users without any sanitization

July 26, 2022 (updated August 6, 2022)

This affects all versions of package node-import. The “params” argument of module function can be controlled by users without any sanitization.b. This is then provided to the “eval” function located in line 79 in the index file “index.js”.

References

github.com/advisories/GHSA-pc62-cq5x-3j5g
github.com/mahdaen/node-import/blob/master/index.js%23L79
nvd.nist.gov/vuln/detail/CVE-2020-7678
security.snyk.io/vuln/SNYK-JS-NODEIMPORT-571691

Code Behaviors & Features

Detect and mitigate CVE-2020-7678 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →