Description
TurboBoost Commands has existing protections in place to guarantee that only public methods on Command classes can be invoked; however, the existing checks aren’t as robust as they should be.
Recommendation
Update the @turbo-boost/commands package to the latest compatible version. Followings are version details:
Affected version(s): **>= 0.2.0, < 0.2.2 < 0.1.3** Patched version(s): **0.2.2 0.1.3**
References
Could your website be exposed too?
SmartScanner can check your website for TurboBoost Commands vulnerable to arbitrary method invocation and gives you actionable findings to investigate.
Start a free scanRelated Issues
- depath and cool-path vulnerable to Prototype Pollution via `set()` Method - depath - CVE-2024-38985
- depath and cool-path vulnerable to Prototype Pollution via `set()` Method - CVE-2024-38985
- StimulusReflex arbitrary method call - CVE-2024-28121
- PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF - CVE-2024-4367
You might also like:
See something that needs correcting? Let us knowUpdated March 18, 2024