GitHub Advisoryadvisory · npm

GHSA-82gw-pqf7-q3j2 pym.js CSRF Vulnerability

HIGH Published 2018-03-13 Modified 2023-09-11 Official page ↗
Aliases
CVE-2018-1000086
Ecosystem
npm
Packages
pym.js
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2020-06-16

Affected packages

• npm pym.js: >= 0.4.2, < 1.3.2 → fixed in 1.3.2

Description

NPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 contains a Cross Site Request Forgery (CSRF) vulnerability in Pym.js `_onNavigateToMessage` function. https://github.com/nprapps/pym.js/blob/master/src/pym.js#L573 can result in Arbitrary javascript code execution. This attack appears to be exploitable if the Attacker gains full javascript access to pages with Pym.js embeds, or when user visits an attacker-crafted page. This vulnerability appears to have been fixed in versions 1.3.2 and later.

Related

Alias · CVE (1)

  • CVE-2018-1000086 NPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 contains a Cross ite Request Forgery (CSRF) vulnerability in Pym.js… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References