CVE-2014-7192: Code Injection
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows remote attackers to execute arbitrary code via a crafted file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-7192?
CVE-2014-7192 is considered a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2014-7192?
To fix CVE-2014-7192, upgrade the syntax-error package to version 1.1.1 or later.
Who is affected by CVE-2014-7192?
CVE-2014-7192 affects users of the syntax-error package in Node.js versions up to and including 0.10.32.
Can CVE-2014-7192 be exploited remotely?
Yes, CVE-2014-7192 can be exploited remotely by attackers to execute arbitrary code.
Which software products use the vulnerable syntax-error package related to CVE-2014-7192?
CVE-2014-7192 is used in IBM Rational Application Developer and potentially other products relying on the vulnerable version of the syntax-error package.