CVE-2016-10548 | BDVDB-2026-101349 Detail

HackerOnereduce-css-calc node module

Description#

Arbitrary code execution is possible in reduce-css-calc node module <=1.2.4 through crafted css. This makes cross sites scripting (XSS) possible on the client and arbitrary code injection possible on the server and user input is passed to the `calc` function.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-94 Improper Control of Generation of Code ('Code Injection')

References#

https://gist.github.com/ChALkeR/415a41b561ebea9b341efbb40b802fc9
https://nodesecurity.io/advisories/144

Exploit#

No public exploit known

History#

Version 12018-05-31Record published in the CVE List.
Version 22024-09-16Most recent update recorded in the CVE List.