Description
All versions of larvitbase-www are vulnerable to an Unintended Require. The package exposes an API endpoint and passes a GET parameter unsanitized to an require() call. This allows attackers to execute any .js file in the same folder as the server is running.
Recommendation
No fix is available yet. Followings are affected versions:
- >= 0.0.0
References
Related Issues
- tRPC 11 WebSocket DoS Vulnerability - CVE-2025-43855
- DocsGPT Allows Remote Code Execution - CVE-2025-0868
- Signature Malleabillity in elliptic - CVE-2020-13822
- Joplin Vulnerable to Code Injection - CVE-2022-23340
- Tags:
- npm
- larvitbase-www
Anything's wrong? Let us know Last updated on January 09, 2023