GHSA-4wv4-mgfq-598v: 
JavaScript vulnerability analysis and mitigation

The vulnerability (GHSA-4wv4-mgfq-598v) was identified in the nobelprizeparser npm package, affecting versions prior to 1.0.2. This critical security issue involves code injection through the use of eval function in the package's parsing functionality. The vulnerability was published on February 23, 2021, and was subsequently reviewed and published to the GitHub Advisory Database on March 12, 2021 (GitHub Advisory).

The vulnerability is classified as CWE-94 and stems from the unsafe use of eval() function for parsing JSON data in the package's core functionality. The issue was present in the Parser class constructor where eval() was used to parse JSON data instead of the safer JSON.parse() method. The vulnerability received a Critical severity rating, though no CVE ID was assigned (GitHub Advisory).

The use of eval() for parsing JSON data could allow attackers to inject and execute arbitrary JavaScript code through specially crafted input data, potentially leading to remote code execution in applications using the affected versions of the nobelprizeparser package (GitHub Advisory).

The vulnerability was present in the package's core parsing functionality, making it potentially exploitable whenever the package processes user-controlled input. The issue existed in all versions of the package prior to version 1.0.2 (GitHub Advisory).

The vulnerability was patched in version 1.0.2 of the nobelprizeparser package by replacing the unsafe eval() function with JSON.parse(). Users are advised to upgrade to version 1.0.2 or later to mitigate this security risk (GitHub Commit).