node-rules prior to 5.0.0 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an
eval call when using the
fromJSON function. This may allow attackers to execute arbitrary code in the system if the rules are user-controlled.
Upgrade to version 5.0.0 or later.
publishedAdvisory PublishedMay 20th, 2020
reportedReported by Snyk Security TeamMar 26th, 2020