Remote Code Execution in scratch-vm

Description

MIT Lifelong Kindergarten Scratch scratch-vm before 0.2.0-prerelease.20200714185213 loads extension URLs from untrusted project.json files with certain _ characters, resulting in remote code execution because the URL’s content is treated as a script and is executed as a worker.

Recommendation

Update the scratch-vm package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.2.0-prerelease.20200709173451
• Patched version(s): 0.2.0-prerelease.20200714185213

References

• GHSA-vc9j-fhvv-8vrf
• scratch.mit.edu
• CVE-2020-14000
• CWE-502
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• Remote Code Execution in Angular Expressions - CVE-2020-5219
• react-dev-utils on Windows vulnerable to Remote Code Execution - CVE-2018-6342
• DocsGPT Allows Remote Code Execution - CVE-2025-0868
• Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE) - CVE-2026-23733

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

scratch-vm