CVE-2017-1001004
high
CVSS v3
8.8
CVSS v2
6.8
VIR risk
8.8
Description
Arbitrary JavaScript Execution in typed-function
Predictions
Exploit likelihood
92%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| npm | typed-function | <0.10.6 | 0.10.6 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| typed_function_project | typed_function | {"endExcluding":"0.10.6"} | 0.10.6 |
References
- https://github.com/josdejong/typed-function/blob/master/HISTORY.md#2017-11-18-version-0106
- https://github.com/josdejong/typed-function/commit/6478ef4f2c3f3c2d9f2c820e2db4b4ba3425e6fe
- https://nvd.nist.gov/vuln/detail/CVE-2017-1001004
- https://github.com/josdejong/typed-function/commit/6478ef4f2c3f3c2d9f2c820e2db4b4ba3425e6fe?diff=split#diff-9e1f22c2954a38db1fdf444dbc74e0a8
- https://snyk.io/vuln/SNYK-JS-TYPEDFUNCTION-174139
- https://www.npmjs.com/advisories/819
CWEs
CWE-94 CWE-20
Verify integrity in audit chain (admin only). AS-IS.