Improper Control of Generation of Code (‘Code Injection’)
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-94: Improper Control of Generation of Code (‘Code Injection’) |
| OWASP | A03:2021 - Injection |
| Confidence Level | Low |
| Impact Level | Medium |
| Likelihood Level | Low |
Description#
User-supplied input is passed directly to the toFastProperties function from Bluebird, which internally uses eval(). This allows execution of arbitrary code if the input is not properly validated or sanitized.
Impact#
If exploited, an attacker could run malicious code on your server, potentially gaining unauthorized access, stealing sensitive data, or taking control of the application. This kind of vulnerability can lead to complete system compromise and data breaches.