GitHub Advisoryadvisory · npm

GHSA-52vj-mr2j-f8jh Server-Side Template Injection in formio

CRITICAL Published 2022-06-03 Modified 2024-05-03 Official page ↗
Aliases
CVE-2020-28246
Ecosystem
npm
Packages
formio
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74
Reviewed
2022-06-03

Affected packages

• npm formio: <= 2.0.0 (no fix yet)

Description

A Server-Side Template Injection (SSTI) was discovered in Form.io 2.0.0. This leads to Remote Code Execution during deletion of the default Email template URL. NOTE: the email templating service was removed after 2020. Additionally, the vendor disputes this issue indicating this is sandboxed and only executable by admins.

Related

Alias · CVE (1)

  • CVE-2020-28246 A Server-Side Template Injection (SSTI) was discovered in Form.io 2.0.0. vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References