Remote Code Execution in scratch-vm

Description

MIT Lifelong Kindergarten Scratch scratch-vm before 0.2.0-prerelease.20200714185213 loads extension URLs from untrusted project.json files with certain _ characters, resulting in remote code execution because the URL’s content is treated as a script and is executed as a worker.

Recommendation

Update the scratch-vm package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.2.0-prerelease.20200709173451
• Patched version(s): 0.2.0-prerelease.20200714185213

References

• GHSA-vc9j-fhvv-8vrf
• scratch.mit.edu
• CVE-2020-14000
• CWE-502
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• tRPC 11 WebSocket DoS Vulnerability - CVE-2025-43855
• DocsGPT Allows Remote Code Execution - CVE-2025-0868
• Signature Malleabillity in elliptic - CVE-2020-13822
• Joplin Vulnerable to Code Injection - CVE-2022-23340

Tags:

npm

scratch-vm