CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2020-7678
Critical (9.8) in node-import project node-import. EPSS 1.2% chance of exploitation in the next 30 days.
This affects all versions of package node-import. The "params" argument of module function can be controlled by users without any sanitization.b. This is then provided to the “eval” function located in line 79 in the index file "index.js".
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- node-import_project:node-import
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-pc62-cq5x-3j5g | npm | node-import | <=0.9.2 | no fix published |