Arbitrary JavaScript Execution in typed-function

HOCH 8.8CVE-2017-1001004 · GHSA-3qh4-r86r-grvm · Published 27/11/2017 · updated 17/06/2026

Kurz gesagt

CVE-2017-1001004 ist eine Schwachstelle (HOCH (CVSS 8.8)) in typed function (typed function project), typed-function.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.9%, höher als bei 79.6% aller Schwachstellen.
Abhilfe: auf 0.10.6 oder neuer aktualisieren.

Package	Affected versions	Patched versions
typed function typed_function_project	`< 0.10.6`	`0.10.6`
typed-function npm	`< 0.10.6`	`0.10.6`

Description

Versions of typed-function prior to 0.10.6 are vulnerable to Arbitrary JavaScript Execution. Function names are not properly sanitized and may allow an attacker to execute arbitrary code.

Recommendation

Upgrade to version 0.10.6 or later.

NVD description

typed-function before 0.10.6 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.

References

nvd.nist.gov/vuln/detail/CVE-2017-1001004 · ADVISORY
josdejong/typed-function commit 6478ef4 · WEB
josdejong/typed-function commit 6478ef4 · WEB
josdejong/typed-function · WEB
snyk.io/vuln/SNYK-JS-TYPEDFUNCTION-174139 · WEB
npmjs.com/advisories/819 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free