GHSA-5vj8-3v2h-h38v

Source

https://github.com/advisories/GHSA-5vj8-3v2h-h38v

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-5vj8-3v2h-h38v/GHSA-5vj8-3v2h-h38v.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5vj8-3v2h-h38v

Published

2020-09-04T18:04:08Z

Modified

2022-04-28T19:57:43Z

Summary

Remote Code Execution in next

Details

Versions of next prior to 5.1.0 are vulnerable to Remote Code Execution. The /path: route fails to properly sanitize input and passes it to a require() call. This allows attackers to execute JavaScript code on the server. Note that prior version 0.9.9 package next npm package hosted a different utility (0.4.1 being the latest version of that codebase), and this advisory does not apply to those versions.

Recommendation

Upgrade to version 5.1.0.

Database specific

{
    "cwe_ids":  [
        "CWE-20"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T19:02:46Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

npm / next

Package

Name: next; View open source insights on deps.dev
Purl: pkg:npm/next

Affected ranges

Type: SEMVER
Events: Introduced

0.9.9

Fixed

5.1.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-5vj8-3v2h-h38v/GHSA-5vj8-3v2h-h38v.json"