CVE-2022-21122

PoC —

CVSS 3.1

9.8 critical

EPSS

3%p84

Published

Jun 8, 2022 (Jun 8, 2022)

Modified

Jun 17, 2026

Description

The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor.

Vendors: metarhia
Products: metacalc
Weakness: CWE-94
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.5%)

In the news0 stories

No ingested article mentions this CVE yet.