From 0aa1ed816c85e9bb3e4a14dd71a3a2afac04664f Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 2 Dec 2024 20:12:43 +0000
Subject: [PATCH] Publish GHSA-q849-wxrc-vqrp

---
 .../GHSA-q849-wxrc-vqrp.json                  | 54 +++++++++++++++++++
 1 file changed, 54 insertions(+)
 create mode 100644 advisories/github-reviewed/2024/12/GHSA-q849-wxrc-vqrp/GHSA-q849-wxrc-vqrp.json

diff --git a/advisories/github-reviewed/2024/12/GHSA-q849-wxrc-vqrp/GHSA-q849-wxrc-vqrp.json b/advisories/github-reviewed/2024/12/GHSA-q849-wxrc-vqrp/GHSA-q849-wxrc-vqrp.json
new file mode 100644
index 00000000000..e5eabaaa861
--- /dev/null
+++ b/advisories/github-reviewed/2024/12/GHSA-q849-wxrc-vqrp/GHSA-q849-wxrc-vqrp.json
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-q849-wxrc-vqrp",
+  "modified": "2024-12-02T20:11:39Z",
+  "published": "2024-12-02T20:11:39Z",
+  "aliases": [],
+  "summary": "hull.js Code Injection Vulnerability",
+  "details": "Versions of the library from 0.2.2 to 1.0.9 are vulnerable to the arbitrary code execution due to unsafe usage of `new Function(...)` in the module that handles points format. Applications passing the 3rd parameter to the `hull` function without sanitising may be impacted. The vulnerability has been fixed in version 1.0.10, please update the library. Check project homepage on GitHub to see how to fetch the latest version: https://github.com/andriiheonia/hull?tab=readme-ov-file#npm-package",
+  "severity": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "hull.js"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.2.2"
+            },
+            {
+              "fixed": "1.0.10"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/AndriiHeonia/hull/security/advisories/GHSA-q849-wxrc-vqrp"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/AndriiHeonia/hull/commit/9de6f9549b74fbb68bf4d5a449147b4c1d7cda0a"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/AndriiHeonia/hull"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-94"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-12-02T20:11:39Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file