Code Injection in cryo

Description

All versions of cryo are vulnerable to code injection due to an Insecure implementation of deserialization.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.0.6

References

• GHSA-38f5-ghc2-fcmv
• hackerone.com
• www.npmjs.com
• CVE-2018-3784
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin (GHSA-2h87-4q2w-v4hf) - CVE-2023-22621
• Unsanitized JavaScript code injection possible in gatsby-plugin-mdx - CVE-2022-25863
• Code injection in electerm - CVE-2020-23256
• gatsby-transformer-remark has possible unsanitized JavaScript code injection - CVE-2023-22491

Tags:

npm

cryo