CVE-2020-7777

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

This affects all versions of package jsen. If an attacker can control the schema file, it could run arbitrary JavaScript code on the victim machine. In the module description and README file there is no mention about the risks of untrusted schema files, so I assume that this is applicable. In particular the required field of the schema is not properly sanitized. The resulting string that is build based on the schema definition is then passed to a Function.apply();, leading to an Arbitrary Code Execution.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Nov 23, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-77787.3This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can le CVE-2020-77797.5All versions of package djvalidator are vulnerable to Regular Expression Denial of Service (ReDoS) by sending crafted invalid emails - for e CVE-2020-77808.8This affects the package com.softwaremill.akka-http-session:core_2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.1 CVE-2020-77819.8This affects the package connection-tester before 0.2.1. The injection point is located in line 15 in index.js. The following PoC demonstrat CVE-2020-77829.8This affects all versions of package spritesheet-js. It depends on a vulnerable package platform-command. The injection point is located in CVE-2020-77849.8This affects all versions of package ts-process-promises. The injection point is located in line 45 in main entry of package in lib/process-CVE-2020-77859.8This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js.CVE-2020-77869.8This affects all versions of package macfromip. The injection point is located in line 66 in macfromip.js.CVE-2020-77878.2This affects all versions of package react-adal. It is possible for a specially crafted JWT token and request URL can cause the nonce, sessi CVE-2020-77889.8This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they CVE-2020-77895.6This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options pa CVE-2020-77905.3This affects the package spatie/browsershot from 0.0.0. By specifying a URL in the file:// protocol an attacker is able to include arbitrary