GHSA-xrr6-6ww3-f3qm

Source

https://github.com/advisories/GHSA-xrr6-6ww3-f3qm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-xrr6-6ww3-f3qm/GHSA-xrr6-6ww3-f3qm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xrr6-6ww3-f3qm

Published

2020-09-02T21:25:58Z

Modified

2020-08-31T18:39:27Z

Summary

Sandbox Breakout / Arbitrary Code Execution in value-censorship

Details

All versions of value-censorship are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to validate async function constructors allowing attackers to execute arbitrary code.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Database specific

{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:39:27Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

https://www.npmjs.com/advisories/888

Affected packages

npm / value-censorship

Package

Name: value-censorship; View open source insights on deps.dev
Purl: pkg:npm/value-censorship

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-xrr6-6ww3-f3qm/GHSA-xrr6-6ww3-f3qm.json"