CVE-2017-1001004
Arbitrary JavaScript Execution in typed-function
typed-function before 0.10.6 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
typed-function before 0.10.6 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.
- Record
CVE-2017-1001004- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-94, CWE-20
- Updated
- 2026-11-02
CVE List No score
typed-function before 0.10.6 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.
- Record
CVE-2017-1001004- Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2020-0712 No score
typed-function before 0.10.6 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.
- Record
EUVD-2020-0712- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3qh4-r86r-grvm No score
Arbitrary JavaScript Execution in typed-function
Versions of typed-function prior to 0.10.6 are vulnerable to Arbitrary JavaScript Execution. Function names are not properly sanitized and may allow an attacker to execute arbitrary code.
Recommendation
Upgrade to version 0.10.6 or later.
- Record
GHSA-3qh4-r86r-grvm- Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
typed-function before 0.10.6 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.
- Record
CVE-2017-1001004- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-3qh4-r86r-grvm No score
Arbitrary JavaScript Execution in typed-function
Versions of typed-function prior to 0.10.6 are vulnerable to Arbitrary JavaScript Execution. Function names are not properly sanitized and may allow an attacker to execute arbitrary code.
Recommendation
Upgrade to version 0.10.6 or later.
- Record
GHSA-3qh4-r86r-grvm- Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typed-functionnpm |
before 0.10.6 | 0.10.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-1001004 is a high vulnerability (CVSS 8.8) in Typed-function, published November 27, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.88%, the 79th percentile. Fixed in typed-function 0.10.6.
References
github.com/josdejong/typed-function/commit/6478ef4f2c3f3c2d9f2c820e2db4b4ba3425e6fe
snyk.io/vuln/SNYK-JS-TYPEDFUNCTION-174139
npmjs.com/advisories/819
nvd.nist.gov/vuln/detail/CVE-2017-1001004