{"action":"Upgrade @saltcorn/plugins-loader to 1.0.0-beta.14 or later.","affected":[{"fixed":"1.0.0-beta.14","introduced":"0"}],"component":"@saltcorn/plugins-loader","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["1.0.0-beta.14"],"ghsa_id":"GHSA-fm76-w8jw-xf8m","id":"tcs_01M5KFNRHMMHWJ3NWWGD3RAV7F","modified_at":"2024-10-03T22:21:24Z","published_at":"2024-10-03T22:21:24Z","references":["https://osv.dev/vulnerability/GHSA-fm76-w8jw-xf8m","https://github.com/saltcorn/saltcorn/security/advisories/GHSA-fm76-w8jw-xf8m","https://github.com/saltcorn/saltcorn/commit/024f19a7e079913f62f4a2335ab04116ddb68192","https://github.com/saltcorn/saltcorn","https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/plugins-loader/download_utils.js#L112","https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/plugins-loader/plugin_installer.js#L41-L61","https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/saltcorn-data/models/plugin.ts#L44","https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/load_plugins.js#L64-L65","https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/plugins.js#L1400"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-fm76-w8jw-xf8m","url":"https://osv.dev/vulnerability/GHSA-fm76-w8jw-xf8m"}],"summary":"@saltcorn/plugins-loader unsanitized plugin name leads to a remote code execution (RCE) vulnerability when creating plugins using git source"}