Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTR2bW0tbWhjcS00eDlq

Sandbox Bypass Leading to Arbitrary Code Execution in constantinople

Versions of constantinople prior to 3.1.1 are vulnerable to a sandbox bypass which can lead to arbitrary code execution.

Recommendation

Update to version 3.1.1 or later.

Permalink: https://github.com/advisories/GHSA-4vmm-mhcq-4x9j
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTR2bW0tbWhjcS00eDlq
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 5 years ago
Updated: almost 2 years ago

CVSS Score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Identifiers: GHSA-4vmm-mhcq-4x9j
References:

• https://github.com/pugjs/constantinople/commit/01d409c0d081dfd65223e6b7767c244156d35f7f
• https://bugzilla.redhat.com/show_bug.cgi?id=1577703
• https://www.npmjs.com/advisories/568
• https://snyk.io/vuln/npm:constantinople:20180421
• https://github.com/advisories/GHSA-4vmm-mhcq-4x9j

Repository: https://github.com/pugjs/constantinople
Blast Radius: 53.3

Affected Packages