What’s Vulnerable › Vulnerabilities

CVE-2014-7192

• Severity: critical (CVSS 10.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 13.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2014-12-11 · updated 2026-06-17
• Weakness: CWE-94

Description

Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows remote attackers to execute arbitrary code via a crafted file.

Affected products

• Joyent Node.Js: through 0.10.32

References

• http://www-01.ibm.com/support/docview.wss?uid=swg21690815
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96728
• https://github.com/substack/node-syntax-error/commit/9aa4e66eb90ec595d2dba55e6f9c2dd9a668b309
• https://nodesecurity.io/advisories/syntax-error-potential-script-injection
• http://www-01.ibm.com/support/docview.wss?uid=swg21690815
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96728
• https://github.com/substack/node-syntax-error/commit/9aa4e66eb90ec595d2dba55e6f9c2dd9a668b309
• https://nodesecurity.io/advisories/syntax-error-potential-script-injection

Get alerted when CVE-2014-7192 or the next vulnerability affects your stack