Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

react-editable-json-tree

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 10.0npmAmendedPublished

    React Editable Json Tree vulnerable to arbitrary code execution via function parsing

    CVE-2022-36010 · GHSA-j3rv-w43q-f9x2

    Affected
    • npm react-editable-json-tree < 2.2.2
    Fixed in
    2.2.2· Vendor fix available
    Issue
    Impact Our library allows strings to be parsed as functions and stored as a specialized component, JsonFunctionValue. To do this, Javascript's eval function was used to execute strings that begin with "function" as Javascript. This was an oversight that unfortunately allows arbitrary code to be executed if it exists as a value within the JSON structure being displayed. Given that this component may often be used to display data from arbitrary, untrusted sources, this is extremely dangerous. One important note is that users who have defined a custom onSubmitValueParser callback prop on the JsonTree component should be unaffected. This vulnerability exists in the default onSubmitValueParser prop which calls parse. Patches We have decided on a two-pronged approach to patching this vulnerability: 1. Create a patch update that adds a workaround which is not enabled by default to preserve backwards-compatibility 2. On the next major update, we will enable this workaround by default The…

    Recommended action: Upgrade to 2.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →