CVE-2022-21122 Arbitrary Code Execution
Attackers can execute arbitrary code by accessing the Function constructor via the exposed Math class in the metacalc library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-21122?
CVE-2022-21122 is a critical code injection vulnerability in metacalc, published on 3 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor.
Weakness: CWE-94
Which versions are affected by CVE-2022-21122?
2 open source packages ship an affected version, including metacalc. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
metacalc npm | All versions | 0.0.2 |
metacalc npm | All versions | 0.0.2 |
Products include Metarhia Metacalc.
How do I fix CVE-2022-21122?
Upgrade metacalc to 0.0.2 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-21122 being exploited?
There is no known exploitation of CVE-2022-21122 in the wild and no public exploit code.
Sources
Also known as GHSA-5gc4-cx9x-9c43, SNYK-JS-METACALC-2826197.