hull.js Code Injection Vulnerability
Priority LOW 38CWE-94Published · Updated
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Code execution
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-94.
Summary
Versions of the library from 0.2.2 to 1.0.9 are vulnerable to the arbitrary code execution due to unsafe usage of `new Function(...)` in the module that handles points format. Applications passing the 3rd parameter to the `hull` function without sanitising may be impacted. The vulnerability has been fixed in version 1.0.10, please update the library. Check project homepage on GitHub to see how to fetch the latest version: https://github.com/andriiheonia/hull?tab=readme-ov-file#npm-package
Why it matters now
Fix Fixed hull.js (npm): 1.0.10
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | hull.js (npm) | 0.2.2 to before 1.0.10 | 1.0.10 | Patch available | GHSA-q849-wxrc-vqrp |
- hull.js (npm) Vendor— Affected 0.2.2 to before 1.0.10 Fixed in 1.0.10 Patch available GHSA-q849-wxrc-vqrp
Remediation
- Fix · GHSA-q849-wxrc-vqrp hull.js (npm) Fixed in 1.0.10 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-q849-wxrc-vqrp
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences