Execution with Unnecessary Privileges in arc-electron

Description

When the end-user click on the response header that contains a link the target will be opened in ARC new window.

Recommendation

Update the @advanced-rest-client/base package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.1.10
• Patched version(s): 0.1.10

References

• GHSA-v3wr-67px-44xg

Related Issues

• @saltcorn/plugins-loader unsanitized plugin name leads to a remote code execution (RCE) vulnerability when creating plug - Vulnerability
• @saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defst - Vulnerability
• XSS vulnerability allowing arbitrary JavaScript execution - CVE-2021-41174
• Arbitrary Code Execution in handlebars - handlebars - GHSA-q2c6-c6pm-g3gh - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@advanced-rest-client/base