CVE-2022-25921

CVE-2022-25921 is a critical arbitrary code execution vulnerability affecting all versions of the 'morgan-json' package. It stems from a lack of input sanitization, allowing malicious input to be passed to the Function constructor. With a CVSS score of 9.8, this vulnerability is easily exploitable over the network with no user interaction, leading to complete compromise of confidentiality, integrity, and availability. While there are no known active exploits, public exploit code, or Metasploit/Nuclei modules, the vulnerability has garnered significant community discussion, indicating awareness and potential future exploitation.