squirrelly Code Injection vulnerability

Description

squirrellyjs squirrelly v9.0.0 was discovered to contain a code injection vulnerability via the component options.varName. The issue was fixed in version 9.1.0.

Recommendation

Update the squirrelly package to the latest compatible version. Followings are version details:

• Affected version(s): >= 9.0.0, < 9.1.0
• Patched version(s): 9.1.0

References

• GHSA-w5pw-gmcw-rfc8
• samuzora.com
• CVE-2024-40453
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• lilconfig Code Injection vulnerability - CVE-2024-21537
• Valine code injection vulnerability - CVE-2022-38545
• @blakeembrey/template vulnerable to code injection when attacker controls template input - CVE-2024-45390
• JSONPath Plus Remote Code Execution (RCE) Vulnerability - CVE-2024-21534

You might also like:

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

Exploiting Server Version Disclosure

Tags:

npm

squirrelly