GHSA-cr9c-rhq6-vh53

Source

https://github.com/advisories/GHSA-cr9c-rhq6-vh53

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-cr9c-rhq6-vh53/GHSA-cr9c-rhq6-vh53.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-cr9c-rhq6-vh53

Aliases

CVE-2022-29351

Withdrawn

2024-05-17T18:36:05Z

Published

2022-05-17T00:01:44Z

Modified

2026-09-10T03:49:32Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Withdrawn: Code execution via SVG file upload in tiddlywiki

Details

Withdrawn Advisory

This advisory has been withdrawn because it has been found to not be valid. Please see the issue here for more information.

Original Description

An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file.

Database specific

{
    "cwe_ids":  [
        "CWE-434"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-05-25T20:13:42Z",
    "nvd_published_at":  "2022-05-16T14:15:00Z",
    "severity":  "CRITICAL"
}

References

Affected packages

npm / tiddlywiki

Package

Name: tiddlywiki; View open source insights on deps.dev
Purl: pkg:npm/tiddlywiki

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

5.2.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-cr9c-rhq6-vh53/GHSA-cr9c-rhq6-vh53.json"