Arbitrary JavaScript Execution in bassmaster

CRITICAL 10.0CVE-2014-7205 · GHSA-5j3g-jfq3-7jwx · Published 08/10/2014 · updated 17/06/2026

Package	Affected versions	Patched versions
bassmaster bassmaster_project	`< 1.5.2`	`1.5.2`
bassmaster npm	`< 1.5.2`	`1.5.2`

Description

A vulnerability exists in bassmaster <= 1.5.1 that allows for an attacker to provide arbitrary JavaScript that is then executed server side via eval.

Recommendation

Update to bassmaster version 1.5.2 or greater.

NVD description

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors.

References

nvd.nist.gov/vuln/detail/CVE-2014-7205 · ADVISORY
hapijs/bassmaster commit b751602 · WEB
exchange.xforce.ibmcloud.com/vulnerabilities/96730 · WEB
GitHub Advisory GHSA-5j3g-jfq3-7jwx · ADVISORY
hapijs/bassmaster · PACKAGE
exploit-db.com/exploits/40689 · WEB
npmjs.com/advisories/1 · WEB
openwall.com/lists/oss-security/2014/09/30/10 · WEB
securityfocus.com/bid/70180 · WEB
nodesecurity.io/advisories/bassmaster_js_injection · Third Party Advisory
exploit-db.com/exploits/40689 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free