Remote Code Execution in scratch-vm

Description

MIT Lifelong Kindergarten Scratch scratch-vm before 0.2.0-prerelease.20200714185213 loads extension URLs from untrusted project.json files with certain _ characters, resulting in remote code execution because the URL’s content is treated as a script and is executed as a worker.

Recommendation

Update the scratch-vm package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.2.0-prerelease.20200709173451
• Patched version(s): 0.2.0-prerelease.20200714185213

References

• GHSA-vc9j-fhvv-8vrf
• scratch.mit.edu
• CVE-2020-14000
• CWE-502
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• Remote Code Execution in Angular Expressions - CVE-2020-5219
• DocsGPT Allows Remote Code Execution - CVE-2025-0868
• react-dev-utils on Windows vulnerable to Remote Code Execution - CVE-2018-6342
• Nuxt vulnerable to remote code execution via the browser when running the test locally - CVE-2024-34344

Tags:

npm

scratch-vm