Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sanitization.
CVSS 4.0MEDIUM 6.9·Network·No auth·No interaction·EPSS 0.01082·Published 2024-11-13·Fixed in 1.0.1CWE-94