CVE-2024-21541

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sanitization. Function generates a new function body and thus care must be given to ensure that the inputs to Function are not attacker-controlled. The risks involved are similar to that of allowing attacker-controlled input to reach eval.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	dom-iterator	< 1.0.1
n/a	org.webjars.npm:dom-iterator	< *
dom-iterator	dom-iterator	< *

References

Timeline

Published: Nov 13, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-215428.6Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destinat CVE-2024-215437.1Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because CVE-2024-215448.6Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to improper URL validation in the se CVE-2024-215458.2Proxmox Virtual Environment is an open-source server management platform for enterprise virtualization. Insufficient safeguards against mali CVE-2024-215469.8Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimety CVE-2024-215477.5Versions of the package spatie/browsershot before 5.0.2 are vulnerable to Directory Traversal due to URI normalisation in the browser where CVE-2024-215487.5Versions of the package bun after 0.0.12 and before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An atta CVE-2024-215498.6Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the se CVE-2024-21554.3A vulnerability was found in SourceCodester Best POS Management System 1.0 and classified as problematic. This issue affects some unknown pr CVE-2024-215506.1SteVe is an open platform that implements different version of the OCPP protocol for Electric Vehicle charge points, acting as a central ser CVE-2024-215529.8All versions of `SuperAGI` are vulnerable to Arbitrary Code Execution due to unsafe use of the ‘eval’ function. An attacker could induce the CVE-2024-21569.8A vulnerability was found in SourceCodester Best POS Management System 1.0. It has been classified as critical. Affected is an unknown funct