Remote Code Execution in scratch-vm

Description

MIT Lifelong Kindergarten Scratch scratch-vm before 0.2.0-prerelease.20200714185213 loads extension URLs from untrusted project.json files with certain _ characters, resulting in remote code execution because the URL’s content is treated as a script and is executed as a worker.

Recommendation

Update the scratch-vm package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.2.0-prerelease.20200709173451
• Patched version(s): 0.2.0-prerelease.20200714185213

References

• GHSA-vc9j-fhvv-8vrf
• scratch.mit.edu
• CVE-2020-14000
• CWE-502
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• Expo SDK has an OAuth vulnerability - CVE-2023-28131
• tRPC 11 WebSocket DoS Vulnerability - CVE-2025-43855
• @rpldy/uploader prototype pollution - CVE-2024-57082
• Signature Malleabillity in elliptic - CVE-2020-13822

Tags:

npm

scratch-vm