TI-2022-05528 Aliases CVE-2022-21122 GHSA-5gc4-cx9x-9c43

Arbitrary code execution in metacalc

MEDIUM 47CWE-94Published 2022-06-03 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor.

Why it matters now

EPSS 0.02683 85th percentileScored 2026-11-07

Fix Fixed metacalc: 0.0.2metacalc (npm): 0.0.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	metacalc	before 0.0.2	0.0.2	Patch available	CNA
—	metacalc (npm)	before 0.0.2	0.0.2	Patch available	GHSA-5gc4-cx9x-9c43

metacalc Vendor— Affected before 0.0.2 Fixed in 0.0.2 Patch available CNA
metacalc (npm) Vendor— Affected before 0.0.2 Fixed in 0.0.2 Patch available GHSA-5gc4-cx9x-9c43

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:metarhia:metacalc::::::::	before 0.0.2	Vulnerable	Metarhia

cpe:2.3:a:metarhia:metacalc:*:*:*:*:*:*:*:* Versions before 0.0.2 Vulnerable ·Metarhia

Remediation

Fix · CNA metacalc Fixed in 0.0.2
Fix · GHSA-5gc4-cx9x-9c43 metacalc (npm) Fixed in 0.0.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-21122
2026-10-03 Alias added: GHSA-5gc4-cx9x-9c43

References

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-21122

Other 1

https://github.com/metarhia/metacalc

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences