TI-2017-14724 Aliases CVE-2017-1001004 GHSA-3qh4-r86r-grvm

Code injection in typed-function

MEDIUM 42CWE-94Published 2017-11-27 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

typed-function before 0.10.6 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.

Why it matters now

EPSS 0.01884 79th percentileScored 2026-11-07

Fix Fixed typed-function (npm): 0.10.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
typed-function	typed-function	0.10.6	—	No fix listed	CNA
—	typed-function (npm)	before 0.10.6	0.10.6	Patch available	GHSA-3qh4-r86r-grvm

typed-function Vendortyped-function Affected 0.10.6 Fixed in — No fix listed CNA
typed-function (npm) Vendor— Affected before 0.10.6 Fixed in 0.10.6 Patch available GHSA-3qh4-r86r-grvm

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:typed_function_project:typed_function::::::::	before 0.10.6	Vulnerable	Typed Function Project

cpe:2.3:a:typed_function_project:typed_function:*:*:*:*:*:*:*:* Versions before 0.10.6 Vulnerable ·Typed Function Project

Remediation

Fix · GHSA-3qh4-r86r-grvm typed-function (npm) Fixed in 0.10.6 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2017-1001004
2026-10-03 Alias added: GHSA-3qh4-r86r-grvm

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2017-1001004

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences