Arbitrary code execution via untrusted rule evaluation

Code injection in Mithun Satheesh node-rules 3.0.0 through 4.0.2 allows attackers to execute arbitrary JavaScript through crafted rules. The fromJSON() method passes attacker-controlled condition and consequence strings directly to eval(), converting both into executable functions without validation or isolation. Exploitation requires a consuming application to supply untrusted rules to that API, and injected code runs with the privileges and data access of the host process.