AIKIDO-2025-10411
@prismatic-io/prism is vulnerable to Code Injection
42
Medium Risk
This Affects:
@prismatic-io/prismTL;DR
Affected versions of this package are vulnerable to Code Injection via String Interpolation due to unsanitized dynamic values (e.g., page.name, configVar.name, input.value) being directly embedded into generated code without proper escaping. An attacker could craft malicious input that, when interpolated into the output file, corrupts the generated configuration or leads to remote code execution (RCE) if the generated file is later evaluated or imported in an unsafe manner.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@prismatic-io/prism is vulnerable to Code Injection in versions 7.3.0 - 7.6.0.
How to fix this
Upgrade the @prismatic-io/prism library to the patch version.
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant