Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXhmMjctanF3di1nZjNy

Unintended Require in larvitbase-api

Versions of larvitbase-api prior to 0.5.4 are vulnerable to an Unintended Require. The package exposes an API endpoint and passes a GET parameter unsanitized to an require() call. This allows attackers to execute any .js file in the same folder as the server is running.

Recommendation

Upgrade to version 0.5.4 or later.

Permalink: https://github.com/advisories/GHSA-xf27-jqwv-gf3r
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXhmMjctanF3di1nZjNy
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 5 years ago
Updated: about 1 year ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Percentage: 0.00102
EPSS Percentile: 0.42529

Identifiers: GHSA-xf27-jqwv-gf3r, CVE-2019-5479
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-5479
• https://hackerone.com/reports/566056
• https://www.npmjs.com/advisories/1120
• https://github.com/advisories/GHSA-xf27-jqwv-gf3r

Blast Radius: 0.0

Affected Packages