QwikSec

Security Database

CVE

CWE

Training

CVE-2016-10548

Published: May 31, 2018

Modified: Sep 16, 2024

PUBLISHED

Description

Arbitrary code execution is possible in reduce-css-calc node module <=1.2.4 through crafted css. This makes cross sites scripting (XSS) possible on the client and arbitrary code injection possible on the server and user input is passed to the `calc` function.

Vendor	Product	Versions
HackerOne	reduce-css-calc node module	affected `<=1.2.4`

Weaknesses (CWE)

References

https://gist.github.com/ChALkeR/415a41b561ebea9b341efbb40b802fc9

x_refsource_MISC

https://nodesecurity.io/advisories/144

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.