Code Injection in cryo

Description

All versions of cryo are vulnerable to code injection due to an Insecure implementation of deserialization.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.0.6

References

• GHSA-38f5-ghc2-fcmv
• hackerone.com
• www.npmjs.com
• CVE-2018-3784
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• [Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat - @theia/ai-code-completion - CVE-2026-46580
• [Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat - @theia/ai-claude-code - CVE-2026-46580
• Editor.js vulnerable to Code Injection - CVE-2022-23474
• TypeORM: migration:generate template-literal code injection - CVE-2026-73651

You might also like:

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

cryo