GHSA-cwcp-6c48-fm7m

Suggest an improvement
Source
https://github.com/advisories/GHSA-cwcp-6c48-fm7m
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-cwcp-6c48-fm7m/GHSA-cwcp-6c48-fm7m.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-cwcp-6c48-fm7m
Aliases
Published
2020-09-01T16:39:38Z
Modified
2023-11-14T21:08:18Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Unsafe eval() in summit allows arbitrary code execution
Details

Affected versions of summit allow attackers to execute arbitrary commands via collection names when using the PouchDB driver.

Recommendation

No direct patch is available at this time.

Currently, the best option to mitigate the issue is to avoid using the PouchDB driver, as the package author has abandoned this feature entirely.

Database specific 
{
    "cwe_ids": [
        "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:18:59Z",
    "nvd_published_at": "2018-06-04T19:29:01Z",
    "severity": "CRITICAL"
}
References

Affected packages

npm / summit

Package

Name
summit
View open source insights on deps.dev
Purl
pkg:npm/summit

Affected ranges

Type
SEMVER
Events
Introduced
0.1.0
Last Affected
0.1.22

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-cwcp-6c48-fm7m/GHSA-cwcp-6c48-fm7m.json"