squirrelly Code Injection vulnerability

Description

squirrellyjs squirrelly v9.0.0 was discovered to contain a code injection vulnerability via the component options.varName. The issue was fixed in version 9.1.0.

Recommendation

Update the squirrelly package to the latest compatible version. Followings are version details:

• Affected version(s): >= 9.0.0, < 9.1.0
• Patched version(s): 9.1.0

References

• GHSA-w5pw-gmcw-rfc8
• samuzora.com
• CVE-2024-40453
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• JSONPath Plus Remote Code Execution (RCE) Vulnerability - CVE-2024-21534
• nuxt Code Injection vulnerability - CVE-2023-3224
• @langchain/community SQL Injection vulnerability - CVE-2024-7042
• Systeminformation has command injection vulnerability in getWindowsIEEE8021x (SSID) - CVE-2024-56334

Tags:

npm

squirrelly