Code Injection in cryo

Description

All versions of cryo are vulnerable to code injection due to an Insecure implementation of deserialization.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.0.6

References

• GHSA-38f5-ghc2-fcmv
• hackerone.com
• www.npmjs.com
• CVE-2018-3784
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Eta vulnerable to Code Injection via templates rendered with user-defined data - CVE-2022-25967
• Unsanitized JavaScript code injection possible in gatsby-plugin-mdx - CVE-2022-25863
• lodash vulnerable to Code Injection via `_.template` imports key names - CVE-2026-4800
• lodash vulnerable to Code Injection via `_.template` imports key names - lodash-es - CVE-2026-4800

You might also like:

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

cryo