Arbitrary JavaScript Execution in bassmaster (GHSA-5j3g-jfq3-7jwx)
Published: 2017-10-24T18:33:36Z
Aliases: CVE-2014-7205
Severity: CRITICAL · CWE: CWE-94

A vulnerability exists in bassmaster <= 1.5.1 that allows for an attacker to provide arbitrary JavaScript that is then executed server side via eval.


## Recommendation

Update to bassmaster version 1.5.2 or greater.

Affected packages:
package: ecosystem: npm
name: bassmaster
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.5.2