@saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defst

Description

The endpoint /site-structure/localizer/save-string/:lang/:defstring accepts two parameter values: lang and defstring. These values are used in an unsafe way to set the keys and value of the cfgStrings object.

Recommendation

Update the @saltcorn/server package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.0.0-beta.13
• Patched version(s): 1.0.0-beta.14

References

• GHSA-78p3-fwcq-62c2
• CWE-1321

Related Issues

• Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer - Vulnerability
• @saltcorn/plugins-loader unsanitized plugin name leads to a remote code execution (RCE) vulnerability when creating plug - Vulnerability
• @saltcorn/data vulnerable to SQL Injection via jsexprToSQL Literal Handler - Vulnerability
• DbGate: Remote Code Execution via functionName injection in loadReader endpoint - CVE-2026-48017

You might also like:

These 7 PHP mistakes leave your website open to the hackers

44 New SQL Injection Tests for WordPress in SmartScanner 1.8

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

@saltcorn/server