CVE-2020-7672: 
JavaScript vulnerability analysis and mitigation

The vulnerability CVE-2020-7672 affects the mosc package, which is a simple inline object model builder for NodeJS. The vulnerability was discovered and disclosed on June 5, 2020, by the JHU System Security Lab. This arbitrary code execution vulnerability affects all versions of the mosc package (Snyk).

The vulnerability allows arbitrary code execution through user input provided to the properties argument, which is executed by the eval function. The vulnerability has been assigned a CVSS v3.1 base score of 8.6 (High), indicating its severe nature. The attack vector is network-based, with low attack complexity, requiring no privileges or user interaction (Snyk).

The vulnerability can lead to a total loss of confidentiality, with potential access to restricted information. It allows modification of data, though with limited control over the consequences. The availability impact is moderate, potentially causing reduced performance or interruptions in resource availability (Snyk).

The vulnerability is exploitable remotely without requiring any special privileges or user interaction. Snyk has confirmed the existence of a proof-of-concept exploit, and the EPSS (Exploit Prediction Scoring System) indicates a 1.29% probability of exploitation (86th percentile), suggesting a relatively high likelihood of exploitation in the wild (Snyk).

There is currently no fixed version available for the mosc package. Users of this package should consider using alternative solutions or implementing additional security controls to mitigate the risk (Snyk).