Arbitrary JavaScript Execution in typed-function

HIGH 8.8CVE-2017-1001004 · GHSA-3qh4-r86r-grvm · Published 27/11/2017 · updated 17/06/2026

In short

CVE-2017-1001004 is a HIGH (CVSS 8.8) vulnerability affecting typed function (typed function project), typed-function.
Chance of exploitation in the next 30 days (EPSS): 1.9%, higher than 79.6% of all vulnerabilities.
Fix: update to 0.10.6 or later.

Package	Affected versions	Patched versions
typed function typed_function_project	`< 0.10.6`	`0.10.6`
typed-function npm	`< 0.10.6`	`0.10.6`

Description

Versions of typed-function prior to 0.10.6 are vulnerable to Arbitrary JavaScript Execution. Function names are not properly sanitized and may allow an attacker to execute arbitrary code.

Recommendation

Upgrade to version 0.10.6 or later.

NVD description

typed-function before 0.10.6 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.

References

nvd.nist.gov/vuln/detail/CVE-2017-1001004 · ADVISORY
josdejong/typed-function commit 6478ef4 · WEB
josdejong/typed-function commit 6478ef4 · WEB
josdejong/typed-function · WEB
snyk.io/vuln/SNYK-JS-TYPEDFUNCTION-174139 · WEB
npmjs.com/advisories/819 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free