CVE-2017-1001004
high
CVSS v3
8.8
CVSS v4 NEW
—
VIR risk
8.8
Description
Arbitrary JavaScript Execution in typed-function
Predictions
Exploit likelihood
92%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| npm | typed-function | <0.10.6 | 0.10.6 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| typed_function_project | typed_function | {"endExcluding":"0.10.6"} | 0.10.6 |
References
- https://github.com/josdejong/typed-function/blob/master/HISTORY.md#2017-11-18-version-0106
- https://github.com/josdejong/typed-function/commit/6478ef4f2c3f3c2d9f2c820e2db4b4ba3425e6fe
- https://nvd.nist.gov/vuln/detail/CVE-2017-1001004
- https://github.com/josdejong/typed-function/commit/6478ef4f2c3f3c2d9f2c820e2db4b4ba3425e6fe?diff=split#diff-9e1f22c2954a38db1fdf444dbc74e0a8
- https://snyk.io/vuln/SNYK-JS-TYPEDFUNCTION-174139
- https://www.npmjs.com/advisories/819
CWEs
CWE-94 CWE-20
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.