CVE-2023-39532
1 advisory.
npm/ses CVE-2023-39532: critical 9.8, EPSS 1.35%
SES's dynamic import and spread operator provides possible path to arbitrary exfiltration and execution
Action: Upgrade ses to 0.13.5 or later.
npm i ses@0.13.5npm i ses@0.14.5npm i ses@0.15.24npm i ses@0.16.1npm i ses@0.17.1npm i ses@0.18.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.13.0 | 0.13.5 | - |
| 0.14.0 | 0.14.5 | - |
| 0.15.0 | 0.15.24 | - |
| 0.16.0 | 0.16.1 | - |
| 0.17.0 | 0.17.1 | - |
| 0.18.0 | 0.18.7 | - |
Fixed versions
| 0.13.5 | 0.14.5 | 0.15.24 | 0.16.1 | 0.17.1 | 0.18.7 |
Sources
- osv: GHSA-9c4h-3f7h-322r
- https://github.com/endojs/endo/security/advisories/GHSA-9c4h-3f7h-322r
- https://nvd.nist.gov/vuln/detail/CVE-2023-39532
- https://github.com/endojs/endo/commit/fc90c6429604dc79ce8e3355e236ccce2bada041
- https://github.com/endojs/endo
CVE-2023-39532 · published · modified · JSON