Malicious Node.js Module Affects npm Environment Variables
CVE-2017-16057

7.5HIGH

Key Information:

Vendor

Hackerone

Status
Nodemssql Node Module
Vendor
CVE Published:
7 June 2018

What is CVE-2017-16057?

The nodemssql module, identified as malicious, was designed to hijack environment variables within Node.js applications. This module has since been removed from npm to mitigate potential risks to developers and their applications. Users are advised to remain vigilant and review their dependencies for any malicious activities.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

nodemssql node module All versions

References

https://nodesecurity.io/advisories/484
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.