GitHub Advisoryadvisory · npm

GHSA-hw46-vg6w-88fj replicator vulnerable to Deserialization of Untrusted Data

CRITICAL Published 2022-12-15 Modified 2022-12-20 Official page ↗
Aliases
CVE-2021-33420
Ecosystem
npm
Packages
replicator
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2022-12-15

Affected packages

• npm replicator: < 1.0.4 → fixed in 1.0.4

Description

A deserialization issue discovered in inikulin replicator before 1.0.4 allows remote attackers to run arbitrary code via the fromSerializable function in TypedArray object.

Related

Alias · CVE (1)

  • CVE-2021-33420 A deserialization issue discovered in inikulin replicator before 1.0.4 allows remote attackers to run arbitrary code via the… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References