CVE-2020-7675 - cd-messenger through 2.7.26 is vulnerable to Arbitrary Code Execution

Back Back to CVE browser

CRITICAL

cd-messenger through 2.7.26 is vulnerable to Arbitrary Code Execution

Published Jun 10, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 2.51%

Description

cd-messenger through 2.7.26 is vulnerable to Arbitrary Code Execution. User input provided to the `color` argument executed by the `eval` function resulting in code execution.

Affected products

Vendor n/a Product CD-Messenger Default
n/a
- Version
  All versions including 2.7.26
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

CD-Messenger

n/a

Version	Status	Constraints
All versions including 2.7.26	affected	-

Ecosystem	Package	Introduced	Fixed
npm	cd-messenger	0	not fixed

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

References (3)

https://github.com/advisories/GHSA-v756-4whv-48vc
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-7675
https://snyk.io/vuln/SNYK-JS-CDMESSENGER-571493
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://github.com/advisories/GHSA-v756-4whv-48vc		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-7675
https://snyk.io/vuln/SNYK-JS-CDMESSENGER-571493		x_refsource_MISCExploitThird Party Advisory