3 ms·
CVE-2022-23529 – node-jsonwebtoken
- michaelermer 4y agoThis CVE is a joke, there is no attack vector. If an attacker is able to create an object with an executable function in the scope claimed in the CVE, he may just run the malicious code himself.
- zacharyvoase 4y agoIf this is a CVE, then arguably any method invocation on any function argument in any JavaScript library is a CVE, and we might as well throw the whole thing away. Is there a way to challenge this as not-a-CVE?
- michaelermer 4y agoI am trying this on GitHub https://github.com/github/advisory-database/pull/1595 https://github.com/github/advisory-database/pull/1595