GitHub Advisoryadvisory · npm

GHSA-4vmm-mhcq-4x9j Sandbox Bypass Leading to Arbitrary Code Execution in constantinople

CRITICAL Published 2019-06-14 Modified 2021-08-16 Official page ↗

Ecosystem: npm
Packages: constantinople
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Reviewed: 2019-06-14

Affected packages

• npm constantinople: < 3.1.1 → fixed in 3.1.1

Description

Versions of `constantinople` prior to 3.1.1 are vulnerable to a sandbox bypass which can lead to arbitrary code execution. Recommendation Update to version 3.1.1 or later.

References

https://github.com/pugjs/constantinople/commit/01d409c0d081dfd65223e6b7767c244156d35f7f web
https://bugzilla.redhat.com/show_bug.cgi?id=1577703 web
https://snyk.io/vuln/npm:constantinople:20180421 web
https://www.npmjs.com/advisories/568 web