Code Injection in cryo

Description

All versions of cryo are vulnerable to code injection due to an Insecure implementation of deserialization.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.0.6

References

• GHSA-38f5-ghc2-fcmv
• hackerone.com
• www.npmjs.com
• CVE-2018-3784
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Code Injection in cd-messenger - CVE-2020-7675
• Risk of code injection - CVE-2021-21278
• Eta vulnerable to Code Injection via templates rendered with user-defined data - CVE-2022-25967
• Code Injection in jsen - CVE-2020-7777

You might also like:

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

cryo