Summary
A code injection vulnerability in dot-access allows attacker-controlled paths passed to get() to become part of dynamically generated JavaScript.
When the affected function is reachable with untrusted input, a remote attacker may execute operating system commands within the Node.js process.
A code injection vulnerability in dot-access allows attacker-controlled paths passed to get() to become part of dynamically generated JavaScript.
When the affected function is reachable with untrusted input, a remote attacker may execute operating system commands within the Node.js process.
Affected context
The issue occurs in dot-access deployments using affected releases where the get() function receives paths influenced by remote or otherwise untrusted input. Risk is higher when the Node.js process exposes this functionality through a network service and has permissions to access sensitive files, credentials, or operating system resources.
The issue occurs in dot-access deployments using affected releases where the get() function receives paths influenced by remote or otherwise untrusted input. Risk is higher when the Node.js process exposes this functionality through a network service and has permissions to access sensitive files, credentials, or operating system resources.
Exploit preconditions
- Attack surface: An application or service that exposes dot-access
get()functionality - Required access: Ability to supply or influence the path argument, potentially through a remote request
- Trigger point: Construction and evaluation of dynamically generated JavaScript in
index.js - Why exploitation is possible: User-controlled path data is incorporated into executable function source rather than treated solely as a data lookup value
- Attack surface: An application or service that exposes dot-access
get()functionality - Required access: Ability to supply or influence the path argument, potentially through a remote request
- Trigger point: Construction and evaluation of dynamically generated JavaScript in
index.js - Why exploitation is possible: User-controlled path data is incorporated into executable function source rather than treated solely as a data lookup value
Why this happens
The vulnerability results from dynamically constructing JavaScript source code by concatenating a path into a new Function body. This unsafe evaluation pattern allows specially crafted input to alter the intended expression and reach executable runtime capabilities.
The behavior maps to CWE-94: Improper Control of Generation of Code ('Code Injection'), because data supplied through a lookup interface can influence generated program logic instead of remaining constrained to property navigation.
The vulnerability results from dynamically constructing JavaScript source code by concatenating a path into a new Function body. This unsafe evaluation pattern allows specially crafted input to alter the intended expression and reach executable runtime capabilities.
The behavior maps to CWE-94: Improper Control of Generation of Code ('Code Injection'), because data supplied through a lookup interface can influence generated program logic instead of remaining constrained to property navigation.
Potential impact
- Remote attackers may execute arbitrary JavaScript in the Node.js process
- Attackers could run operating system commands with the process privileges
- Sensitive files, environment variables, or application credentials may be exposed
- The application could be used for persistence, data theft, or lateral movement
- Availability may be affected through process disruption or resource consumption
- Remote attackers may execute arbitrary JavaScript in the Node.js process
- Attackers could run operating system commands with the process privileges
- Sensitive files, environment variables, or application credentials may be exposed
- The application could be used for persistence, data theft, or lateral movement
- Availability may be affected through process disruption or resource consumption
General mitigation guidance
Mitigation generally focuses on removing dynamic code generation from path resolution and treating lookup paths strictly as data.
Common defensive patterns include:
- Replacing
new Function,eval, and equivalent runtime code-generation paths with bounded property traversal - Restricting accepted paths to an explicit allowlist or validated grammar
- Rejecting unexpected tokens, accessors, and prototype-related properties
- Separating external input from internal object navigation logic
- Running the Node.js process with least-privilege filesystem, network, and operating system permissions
- Limiting access to sensitive environment variables and child-process capabilities
- Applying defense-in-depth controls such as sandboxing and restrictive process policies where practical
Mitigation generally focuses on removing dynamic code generation from path resolution and treating lookup paths strictly as data.
Common defensive patterns include:
- Replacing
new Function,eval, and equivalent runtime code-generation paths with bounded property traversal - Restricting accepted paths to an explicit allowlist or validated grammar
- Rejecting unexpected tokens, accessors, and prototype-related properties
- Separating external input from internal object navigation logic
- Running the Node.js process with least-privilege filesystem, network, and operating system permissions
- Limiting access to sensitive environment variables and child-process capabilities
- Applying defense-in-depth controls such as sandboxing and restrictive process policies where practical
How teams detect issues like this
Organizations can detect similar issues through:
- Static analysis rules identifying
new Function,eval, or dynamic module execution involving request-derived values - Code review checks for string concatenation or interpolation inside executable JavaScript
- Tests that verify path handling rejects syntax outside an explicitly supported property grammar
- Dependency and software composition analysis for vulnerable package usage
- Runtime monitoring for unexpected child-process creation, command execution, or access to sensitive paths
- Policy enforcement that prohibits dynamic code generation in services processing untrusted input
Automated code review and security scanning tools may help identify these patterns during development.
Organizations can detect similar issues through:
- Static analysis rules identifying
new Function,eval, or dynamic module execution involving request-derived values - Code review checks for string concatenation or interpolation inside executable JavaScript
- Tests that verify path handling rejects syntax outside an explicitly supported property grammar
- Dependency and software composition analysis for vulnerable package usage
- Runtime monitoring for unexpected child-process creation, command execution, or access to sensitive paths
- Policy enforcement that prohibits dynamic code generation in services processing untrusted input
Automated code review and security scanning tools may help identify these patterns during development.
