{"cve":"CVE-2020-7777","nvd":{"published":"2020-11-23T16:15:13.603","modified":"2026-06-17T03:25:25.720","status":"Modified","description":"This affects all versions of package jsen. If an attacker can control the schema file, it could run arbitrary JavaScript code on the victim machine. In the module description and README file there is no mention about the risks of untrusted schema files, so I assume that this is applicable. In particular the required field of the schema is not properly sanitized. The resulting string that is build based on the schema definition is then passed to a Function.apply();, leading to an Arbitrary Code Execution.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":7.2},"cwes":[],"references":["https://github.com/bugventure/jsen/blob/master/lib/jsen.js%23L875","https://snyk.io/vuln/SNYK-JS-JSEN-1014670","https://github.com/bugventure/jsen/blob/master/lib/jsen.js%23L875","https://snyk.io/vuln/SNYK-JS-JSEN-1014670"],"products":["jsen_project:jsen"],"source":"nvd","synced_at":"2026-10-19T21:11:20.317016139+00:00"},"epss":{"cve":"CVE-2020-7777","score":0.02114,"percentile":0.81822,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-vm64-cfqx-3698","url":"https://osv.dev/vulnerability/GHSA-vm64-cfqx-3698","summary":"Code Injection in jsen","modified":"2023-11-08T04:04:09.974138Z","packages":[{"ecosystem":"npm","name":"jsen","purl":"pkg:npm/jsen","ranges":["<=0.6.6"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}