{"id":"CVE-2017-1001004","aliases":["GHSA-3qh4-r86r-grvm"],"url":"https://o3.security/vulnerability/CVE-2017-1001004","summary":"Arbitrary JavaScript Execution in typed-function","details":"Versions of `typed-function` prior to 0.10.6 are vulnerable to Arbitrary JavaScript Execution. Function names are not properly sanitized and may allow an attacker to execute arbitrary code.\n\n\n## Recommendation\n\nUpgrade to version 0.10.6 or later.","published":"2017-11-27T14:29:00.333Z","modified":"2026-07-08T12:05:22.671451Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"typed-function","fixedVersion":"0.10.6"}],"fix":{"url":"https://github.com/josdejong/typed-function/commit/6478ef4f2c3f3c2d9f2c820e2db4b4ba3425e6fe","label":"josdejong/typed-function@6478ef4"},"references":[{"type":"WEB","url":"https://github.com/josdejong/typed-function/blob/master/HISTORY.md#2017-11-18-version-0106"},{"type":"FIX","url":"https://github.com/josdejong/typed-function/commit/6478ef4f2c3f3c2d9f2c820e2db4b4ba3425e6fe"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1001004"},{"type":"WEB","url":"https://github.com/josdejong/typed-function/commit/6478ef4f2c3f3c2d9f2c820e2db4b4ba3425e6fe?diff=split#diff-9e1f22c2954a38db1fdf444dbc74e0a8"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-JS-TYPEDFUNCTION-174139"},{"type":"WEB","url":"https://www.npmjs.com/advisories/819"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T12:05:22.671451Z"}}