GHSA-r83x-wj75-v89r

Suggest an improvement
Source
https://github.com/advisories/GHSA-r83x-wj75-v89r
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-r83x-wj75-v89r/GHSA-r83x-wj75-v89r.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-r83x-wj75-v89r
Aliases
Published
2022-05-13T01:32:03Z
Modified
2023-11-08T04:00:21.148313Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Nuclide Improper Input Validation
Details

The hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering. As a result, a malicious URL could be used to render HTML and other content inside of the editor's context, which could potentially be chained to lead to code execution. This issue affected Nuclide prior to v0.290.0.

References

Affected packages

npm / nuclide

Package

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.290.0