Code Injection in pac-resolver

KRITISCH 9.8CVE-2021-23406 · GHSA-9j49-mfvp-vmhm · Published 24/08/2021 · updated 17/06/2026

Kurz gesagt

CVE-2021-23406 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in pac-resolver (pac-resolver project), degenerator, pac-resolver.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.9%, höher als bei 87.2% aller Schwachstellen.
Abhilfe: auf 5.0.0, 3.0.1 oder neuer aktualisieren.

Package	Affected versions	Patched versions
pac-resolver pac-resolver_project	`< 5.0.0`	`5.0.0`
degenerator npm	`< 3.0.1`	`3.0.1`
pac-resolver npm	`< 5.0.0`	`5.0.0`

Description

This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. NOTE: The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer.

NVD description

This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:** The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer.

References

nvd.nist.gov/vuln/detail/CVE-2021-23406 · ADVISORY
TooTallNate/node-degenerator commit 9d25bb6 · WEB
TooTallNate/node-degenerator commit ccc3445 · WEB
github.com/TooTallNate · WEB
TooTallNate/node-pac-resolver release 5.0.0 · WEB
snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1568506 · WEB
snyk.io/vuln/SNYK-JS-PACRESOLVER-1564857 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free