CVE-2020-7674: 
JavaScript vulnerability analysis and mitigation

The access-policy npm package, which is used for encoding and decoding policy JSON files in web applications, was found to contain an Arbitrary Code Execution vulnerability (CVE-2020-7674). The vulnerability was discovered and disclosed on June 5, 2020, by the JHU System Security Lab (Snyk Database).

The vulnerability exists in all versions of the access-policy package. The security flaw occurs when user input provided to the template function is executed by the eval function, resulting in potential code execution. The vulnerability has received a CVSS v3.1 base score of 9.8 (Critical) from NVD and 8.6 (High) from Snyk, indicating its severe nature (Snyk Database).

The vulnerability can lead to a total loss of confidentiality, with all resources within the impacted component potentially being exposed to the attacker. While integrity impact is limited, the vulnerability can affect system availability, causing reduced performance or interruptions in resource availability (Snyk Database).

The vulnerability is considered highly exploitable as it requires no special access conditions or user interaction. An attacker can expect repeatable success when attacking the vulnerable component, and the attack can be executed remotely without requiring any privileges (Snyk Database).

As of the disclosure, there is no fixed version available for the access-policy package. Users of this package should consider using alternative solutions or implementing additional security controls to mitigate the risk (Snyk Database).