Versions of typed-function prior to 0.10.6 are vulnerable to Arbitrary JavaScript Execution. Function names are not properly sanitized and may allow an attacker to execute arbitrary code.

Recommendation

Upgrade to version 0.10.6 or later.

References

• josdejong/typed-function@6478ef4?diff=split#diff-9e1f22c2954a38db1fdf444dbc74e0a8
• https://snyk.io/vuln/SNYK-JS-TYPEDFUNCTION-174139
• https://www.npmjs.com/advisories/819
• https://nvd.nist.gov/vuln/detail/CVE-2017-1001004
• josdejong/typed-function@6478ef4
• https://github.com/josdejong/typed-function/blob/master/HISTORY.md#2017-11-18-version-0106