Code Injection in cryo

Description

All versions of cryo are vulnerable to code injection due to an Insecure implementation of deserialization.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.0.6

References

• GHSA-38f5-ghc2-fcmv
• hackerone.com
• www.npmjs.com
• CVE-2018-3784
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Code injection in electerm - CVE-2020-23256
• Code Injection in cd-messenger - CVE-2020-7675
• react-dev-utils on Windows vulnerable to Remote Code Execution - CVE-2018-6342
• Code Injection in mosc - CVE-2020-7672

Tags:

npm

cryo