Potential for Script Injection in syntax-error

CRITIQUE 10.0CVE-2014-7192 · GHSA-5726-g6r9-5f22 · Published 11/12/2014 · updated 17/06/2026

En bref

CVE-2014-7192 est une vulnérabilité CRITIQUE (CVSS 10.0) touchant node.js (joyent), syntax-error.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 13.0%, plus élevée que 96.3% des vulnérabilités.
Correctif : mettre à jour vers 1.1.1 ou plus récent.

Package	Affected versions	Patched versions
node.js joyent	`≤ 0.10.32`	No fix yet
syntax-error npm	`< 1.1.1`	`1.1.1`

Description

Versions of syntax-error prior to 1.1.1 are affected by a cross-site scripting vulnerability which may allow a malicious file to execute code when browserified.

Recommendation

Update to version 1.1.1 or later.

NVD description

Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows remote attackers to execute arbitrary code via a crafted file.

References

nvd.nist.gov/vuln/detail/CVE-2014-7192 · ADVISORY
substack/node-syntax-error commit 9aa4e66 · WEB
exchange.xforce.ibmcloud.com/vulnerabilities/96728 · WEB
GitHub Advisory GHSA-5726-g6r9-5f22 · ADVISORY
substack/node-browserify · WEB
substack/node-syntax-error · PACKAGE
npmjs.com/advisories/37 · WEB
www-01.ibm.com/support/docview.wss · WEB
nodesecurity.io/advisories/syntax-error-potential-script-injection · Vendor Advisory

Autres vulnérabilités de node.js

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free