CVE-2024-21541
High
Description
Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sanitization. Function generates a new function body and thus care must be given to ensure that the inputs to Function are not attacker-controlled. The risks involved are similar to that of allowing attacker-controlled input to reach eval.
SeverityHigh
CVSS7.3
Exploit probability—
ProductMatthewmueller Dom-iterator
PublishedNov 13, 2024
First seenNov 13, 2024
Weakness typeCWE-94Code injection
How to fix
Update
- dom-iterator1.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| matthewmueller dom-iterator | v ≤ 1.0.0 | — |
| dom-iteratornpm | v < 1.0.1 | 1.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.