CVE-2021-23406 Remote Code Execution (RCE)
Attackers can execute arbitrary code via unsafe PAC file handling in the pac-resolver npm package when processing untrusted input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-23406?
CVE-2021-23406 is a high-severity code injection vulnerability in pac-resolver, published on 24 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:** The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer.
Which versions are affected by CVE-2021-23406?
4 open source packages ship an affected version, including pac-resolver and degenerator. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pac-resolver npm | All versions | 5.0.0 |
pac-resolver npm | All versions | 5.0.0 |
degenerator npm | All versions | 3.0.1 |
degenerator npm | All versions | 3.0.1 |
Products include Pac-Resolver Project Pac-Resolver.
How do I fix CVE-2021-23406?
Upgrade pac-resolver to 5.0.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-23406 being exploited?
There is no known exploitation of CVE-2021-23406 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1790104586, GHSA-9j49-mfvp-vmhm.