Valine code injection vulnerability

Description

Valine was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST request.

Recommendation

Update the valine package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.5.0
• Patched version(s): 1.5.0

References

• GHSA-mcvg-g9wx-v5vx
• CVE-2022-38545
• CWE-74
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• lilconfig Code Injection vulnerability - CVE-2024-21537
• Eta vulnerable to Code Injection via templates rendered with user-defined data - CVE-2022-25967
• Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability - flowise-components - CVE-2026-70477
• Nadesiko3 OS Command Injection vulnerability - CVE-2022-41642

You might also like:

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

Exploiting Server Version Disclosure

Tags:

npm

valine