Maven/org.openrefine.dependencies:butterfly: medium

Butterfly's parseJSON, getJSON functions eval malicious input, leading to remote code execution (RCE)

Action: Upgrade org.openrefine.dependencies:butterfly to 1.2.6 or later.

Affected

Fixed versions

Sources

• osv: GHSA-mpcw-3j5p-p99x
• https://github.com/OpenRefine/simile-butterfly/security/advisories/GHSA-mpcw-3j5p-p99x
• https://github.com/OpenRefine/simile-butterfly/commit/2ad1fa4cd8afe3c920c8e6e04fe7a7df5cf8294e
• https://github.com/OpenRefine/simile-butterfly

published 2024-10-24T18:27:50Z · modified 2024-12-04T05:40:43.793618Z · JSON