Code Injection in cryo

Description

All versions of cryo are vulnerable to code injection due to an Insecure implementation of deserialization.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.0.6

References

• GHSA-38f5-ghc2-fcmv
• hackerone.com
• www.npmjs.com
• CVE-2018-3784
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Code Injection in jsen - CVE-2020-7777
• Open Redirect in urijs - CVE-2022-0868
• Code Injection in mosc - CVE-2020-7672
• openssl.js is malware - CVE-2017-16065

Tags:

npm

cryo