Remote Code Execution in scratch-vm

Description

MIT Lifelong Kindergarten Scratch scratch-vm before 0.2.0-prerelease.20200714185213 loads extension URLs from untrusted project.json files with certain _ characters, resulting in remote code execution because the URL’s content is treated as a script and is executed as a worker.

Recommendation

Update the scratch-vm package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.2.0-prerelease.20200709173451
• Patched version(s): 0.2.0-prerelease.20200714185213

References

• GHSA-vc9j-fhvv-8vrf
• scratch.mit.edu
• CVE-2020-14000
• CWE-502
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• Remote Code Execution in Angular Expressions - CVE-2020-5219
• Angular Expressions - Remote Code Execution when using locals - CVE-2024-54152
• Joplin Remote Code Execution - CVE-2022-40277
• Arbitrary code execution in djv - CVE-2020-28464

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

scratch-vm