GitHub Advisoryadvisory · npm

GHSA-88h9-fc6v-jcw7 Unintended Require in larvitbase-www

MEDIUM Published 2020-09-03 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
larvitbase-www
Severity
Moderate
Reviewed
2020-08-31

Affected packages

• npm larvitbase-www: >= 0.0.0 (no fix yet)

Description

All versions of `larvitbase-www` are vulnerable to an Unintended Require. The package exposes an API endpoint and passes a GET parameter unsanitized to an `require()` call. This allows attackers to execute any `.js` file in the same folder as the server is running. Recommendation No fix is currently available. Consider using an alternative package until a fix is made available.

References