CVE-2022-25921: 
JavaScript vulnerability analysis and mitigation

The morgan-json package, in all versions, contains a critical vulnerability (CVE-2022-25921) that allows Arbitrary Code Execution due to insufficient input sanitization when passing data to the Function constructor. This vulnerability was disclosed on August 29, 2022, affecting all versions of the package (NVD, Snyk).

The vulnerability stems from improper input sanitization when data is passed to the Function constructor in the morgan-json package. The vulnerability has received a CVSS v3.1 base score of 9.8 (Critical), with attack vector being Network-based, low attack complexity, requiring no privileges or user interaction. The scope is unchanged, but impact is high across confidentiality, integrity, and availability (NVD, Snyk).

The vulnerability can lead to a complete compromise of system confidentiality, integrity, and availability. When successfully exploited, it allows attackers to execute arbitrary code, potentially resulting in total loss of system protection and unauthorized access to sensitive information (Snyk).

Currently, there is no fixed version available for the morgan-json package. Users are advised to consider alternative packages or implement additional security controls to mitigate the risk (Snyk).