Potential for Script Injection in syntax-error

CRITICAL 10.0CVE-2014-7192 · GHSA-5726-g6r9-5f22 · Published 11/12/2014 · updated 17/06/2026

Package	Affected versions	Patched versions
node.js joyent	`≤ 0.10.32`	No fix yet
syntax-error npm	`< 1.1.1`	`1.1.1`

Description

Versions of syntax-error prior to 1.1.1 are affected by a cross-site scripting vulnerability which may allow a malicious file to execute code when browserified.

Recommendation

Update to version 1.1.1 or later.

NVD description

Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows remote attackers to execute arbitrary code via a crafted file.

References

nvd.nist.gov/vuln/detail/CVE-2014-7192 · ADVISORY
substack/node-syntax-error commit 9aa4e66 · WEB
exchange.xforce.ibmcloud.com/vulnerabilities/96728 · WEB
GitHub Advisory GHSA-5726-g6r9-5f22 · ADVISORY
substack/node-browserify · WEB
substack/node-syntax-error · PACKAGE
npmjs.com/advisories/37 · WEB
www-01.ibm.com/support/docview.wss · WEB
nodesecurity.io/advisories/syntax-error-potential-script-injection · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free