Potential for Script Injection in syntax-error

published 2014-12-11 11 y ago modified 2026-06-17 4 mo ago also GHSA-5726-g6r9-5f22 , EUVD-2017-0167

cvss: 10.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 13.0%; EPSS 13.0% chance of exploitation in 30 days, percentile 96%
public exploits: 1; Exploit-DB

Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows remote attackers to execute arbitrary code via a crafted file.

Patch / fix

fixed in 1

npm syntax-error 1.1.1

Timeline

2014-07-16 First public exploit (EDB-34090)
2014-12-11 Published

Exploit prediction

13.05% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

EDB-34090 Node Browserify 4.2.0 - Remote Code Execution dos, 2014-07-16
github.com https://github.com/substack/node-syntax-error/commit/9aa4e66eb90ec595d2dba55e6f9c2dd9a668b309 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected packages

ecosystem	package	affected	fixed in
npm	syntax-error	<1.1.1	1.1.1

Classification

Weakness

CWE-94 Improper Control of Generation of Code

References

github.com /substack/node-syntax-error/commit/9aa4e66eb90ec595d2dba55e6f9c2dd9a668b309
web, exploit
nodesecurity.io /advisories/syntax-error-potential-script-injection
vendor-advisory
exchange.xforce.ibmcloud.com /vulnerabilities/96728
vdb-entry, web
www-01.ibm.com /support/docview.wss?uid=swg21690815
web
nvd.nist.gov /vuln/detail/CVE-2014-7192
advisory
github.com /advisories/GHSA-5726-g6r9-5f22
advisory
github.com /substack/node-browserify/blob/master/changelog.markdown#421
web
github.com /substack/node-syntax-error
package
npmjs.com /advisories/37
web

Sources

CVE List CVE-2014-7192
GitHub Advisory GHSA-5726-g6r9-5f22
NVD CVE-2014-7192

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary