GHSA-jvf4-g24p-2qgw

Source

https://github.com/advisories/GHSA-jvf4-g24p-2qgw

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-jvf4-g24p-2qgw/GHSA-jvf4-g24p-2qgw.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-jvf4-g24p-2qgw

Aliases

CVE-2020-7738

Published

2021-05-10T18:37:34Z

Modified

2026-03-13T22:11:56.428275Z

Severity

8.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L CVSS Calculator

Summary

Arbitrary Code Execution in shiba

Details

All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load() of the package js-yaml instead of its secure replacement , safeLoad().

Database specific

{
    "nvd_published_at": "2020-10-02T10:15:00Z",
    "severity": "HIGH",
    "github_reviewed_at": "2021-04-22T22:20:49Z",
    "cwe_ids": [
        "CWE-94"
    ],
    "github_reviewed": true
}

References

Affected packages

npm / shiba

Package

Name: shiba; View open source insights on deps.dev
Purl: pkg:npm/shiba

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.2.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-jvf4-g24p-2qgw/GHSA-jvf4-g24p-2qgw.json"