GitHub Advisoryadvisory · npm

GHSA-cgqv-x5cx-xvqh Arbitrary Code Injection in pouchdb

CRITICAL Published 2018-07-26 Modified 2020-08-31 Official page ↗
Aliases
CVE-2016-10546
Ecosystem
npm
Packages
pouchdb
Severity
Critical
Weaknesses
CWE-94
Reviewed
2020-06-16

Affected packages

• npm pouchdb: < 6.0.5 → fixed in 6.0.5

Description

Affected versions of `pouchdb` do not properly sandbox the code execution engine which executes the map/reduce functions for temporary views and design documents. Under certain circumstances, an attacker could uses this to run arbitrary code on the server. Recommendation Update to version 6.0.5 or later.

Related

Alias · CVE (1)

  • CVE-2016-10546 An arbitrary code injection vector was found in PouchDB 6.0.4 and lesser via the map/reduce functions used in PouchDB temporary views and… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References