Nlp Js
Monthly
Code injection in AXA Group NLP.js 4.27.0 allows remote attackers to execute arbitrary JavaScript via the Evaluator.walkFunction condition-expression pipeline when an embedding application passes attacker-controlled input into the condition argument. Public exploit code exists, but the flaw is not reachable in a default standalone installation; it requires the host application to expose the condition-expression evaluation path, and the project has not responded to issue #1380, so no vendor-released patch was identified at time of analysis. Although the published CVSS 4.0 score is 2.1 and the RCE/code-injection tags draw attention, practical priority is low for typical deployments because exploitation depends on that application-level exposure.
Code injection in AXA Group NLP.js 4.27.0 allows remote attackers to execute arbitrary JavaScript via the Evaluator.walkFunction condition-expression pipeline when an embedding application passes attacker-controlled input into the condition argument. Public exploit code exists, but the flaw is not reachable in a default standalone installation; it requires the host application to expose the condition-expression evaluation path, and the project has not responded to issue #1380, so no vendor-released patch was identified at time of analysis. Although the published CVSS 4.0 score is 2.1 and the RCE/code-injection tags draw attention, practical priority is low for typical deployments because exploitation depends on that application-level exposure.