VYPR
← All advisories
Critical severityNVD Advisory· Published Oct 8, 2014· Updated May 6, 2026

CVE-2014-7205

CVE-2014-7205

Description

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
bassmasternpm
< 1.5.21.5.2

Affected products

1

Patches

1
b751602d8cb7

Remove eval statement

https://github.com/hapijs/bassmasternvcexploderSep 25, 2014via ghsa
commit
1 file changed · +2 −8
  • lib/batch.js+2 −8 modified
    @@ -146,16 +146,10 @@ internals.batch = function (batchRequest, resultsData, pos, parts, callback) {
             var ref = resultsData.resultsMap[parts[i].index];
 
             if (ref) {
-                var value = null;
-
-                try {
-                    eval('value = ref.' + parts[i].value + ';');
-                }
-                catch (e) {
-                    error = new Error(e.message);
-                }
+                var value = ref[parts[i].value]||null;
 
                 if (value) {
+
                     if (value.match && value.match(/^[\w:]+$/)) {
                         path += value;
                     }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

10

News mentions

0

No linked articles in our index yet.