Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Arbitrary Code Execution in underscore #338

Closed
1 of 4 tasks
TheKingTermux opened this issue May 2, 2023 · 0 comments · Fixed by #321
Closed
1 of 4 tasks

Arbitrary Code Execution in underscore #338

TheKingTermux opened this issue May 2, 2023 · 0 comments · Fixed by #321
Assignees
@TheKingTermux
Labels
Auto Create Issues Label for Auto Created Issues Critical This label for Security Severity only Security Label for Security Issues
Milestone
Alice 1.0.6

Comments

@TheKingTermux
Copy link
Owner

Description

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Execution via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Severity Check

  • Low
  • Moderate
  • High
  • Critical

Severity Number

9,8 / 10

CVSS base metrics

  • Attack vector
    Network

  • Attack complexity
    Low

  • Privileges required
    None

  • User interaction
    None

  • Scope
    Unchanged

  • Confidentiality
    High

  • Integrity
    High

  • Availability
    High

  • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Weaknesses
    CWE-94

  • CVE ID
    CVE-2021-23358

  • GHSA ID
    GHSA-cf4h-3jhx-xvhq

  • Source code
    jashkenas/underscore

Information

  • Package
    underscore (npm)

  • Affected versions

= 1.3.2, < 1.12.1

  • Patched versions
    1.12.1

References
@TheKingTermux TheKingTermux added do-not-autoclose Make bot can't close an Issues or PRs Security Label for Security Issues Auto Create Issues Label for Auto Created Issues labels May 2, 2023
@TheKingTermux TheKingTermux added this to the Alice 1.0.6 milestone May 2, 2023
@TheKingTermux TheKingTermux self-assigned this May 2, 2023
@TheKingTermux TheKingTermux mentioned this issue May 2, 2023
Merged
1 task
@TheKingTermux TheKingTermux added the Critical This label for Security Severity only label May 9, 2023
@TheKingTermux TheKingTermux removed the do-not-autoclose Make bot can't close an Issues or PRs label May 16, 2023
@github-actions github-actions bot locked as resolved and limited conversation to collaborators May 18, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@TheKingTermux TheKingTermux

Labels
Auto Create Issues Label for Auto Created Issues Critical This label for Security Severity only Security Label for Security Issues
Projects
None yet
Milestone
Alice 1.0.6
Development

Successfully merging a pull request may close this issue.

chore(deps): update dependency underscore to 1.12.1 [security] TheKingTermux/alice
1 participant
@TheKingTermux