Arbitrary code execution is possible in reduce-css-calc node module <=1.2.4 through crafted css. This makes cross sites scripting (XSS) possible on the client and arbitrary code injection possible on the server and user input is passed to the `calc` function.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: hackerone

Published: 2018-05-31T20:00:00Z

Updated: 2024-09-16T20:03:43.284Z

Reserved: 2017-10-29T00:00:00

Link: CVE-2016-10548

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2018-05-31T20:29:01.783

Modified: 2024-11-21T02:44:14.537

Link: CVE-2016-10548

cve-icon Redhat

No data.