Vulnerabilities (CVE)

Filtered by vendor Matthewmueller Subscribe
Filtered by product Dom-iterator
Total 1 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2024-21541 1 Matthewmueller 1 Dom-iterator 2025-01-14 N/A 7.3 HIGH
Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sanitization. Function generates a new function body and thus care must be given to ensure that the inputs to Function are not attacker-controlled. The risks involved are similar to that of allowing attacker-controlled input to reach eval.