Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS13cThmLXhtcTMtNXZxOc4AAy8R

Remote code execution in broccoli-compass

broccoli-compass v0.2.4 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.

Permalink: https://github.com/advisories/GHSA-wq8f-xmq3-5vq9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13cThmLXhtcTMtNXZxOc4AAy8R
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 1 year ago
Updated: about 1 year ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Percentage: 0.00812
EPSS Percentile: 0.82423

Identifiers: GHSA-wq8f-xmq3-5vq9, CVE-2023-27848
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-27848
• https://github.com/omnitaint/Vulnerability-Reports/blob/9d65add2bca71ed6d6b2e281ee6790a12504ff8e/reports/broccoli-compass/report.md
• https://www.npmjs.com/package/broccoli-compass
• https://github.com/advisories/GHSA-wq8f-xmq3-5vq9

Repository: https://github.com/omnitaint/Vulnerability-Reports
Blast Radius: 11.2

Affected Packages