CVE-2017-1001004
Arbitrary JavaScript Execution in typed-function
EPSS 0.75%
Description
Versions of `typed-function` prior to 0.10.6 are vulnerable to Arbitrary JavaScript Execution. Function names are not properly sanitized and may allow an attacker to execute arbitrary code. ## Recommendation Upgrade to version 0.10.6 or later.
How to fix CVE-2017-1001004
To remediate CVE-2017-1001004, upgrade the affected package to a fixed version below.
- npm/typed-function—upgrade to 0.10.6 or later
Is CVE-2017-1001004 being exploited?
Low — EPSS is 0.8%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 0.10.6