npm/@saltcorn/plugins-loader: high 7.2
@saltcorn/plugins-loader unsanitized plugin name leads to a remote code execution (RCE) vulnerability when creating plugins using git source
Action: Upgrade @saltcorn/plugins-loader to 1.0.0-beta.14 or later.
npm i @saltcorn/plugins-loader@1.0.0-beta.14Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.0.0-beta.14 | - |
Fixed versions
| 1.0.0-beta.14 |
Sources
- osv: GHSA-fm76-w8jw-xf8m
- https://github.com/saltcorn/saltcorn/security/advisories/GHSA-fm76-w8jw-xf8m
- https://github.com/saltcorn/saltcorn/commit/024f19a7e079913f62f4a2335ab04116ddb68192
- https://github.com/saltcorn/saltcorn
- https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/plugins-loader/download_utils.js#L112
- https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/plugins-loader/plugin_installer.js#L41-L61
- https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/saltcorn-data/models/plugin.ts#L44
- https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/load_plugins.js#L64-L65
- https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/plugins.js#L1400
published · modified · JSON