GitHub Advisoryadvisory · npm

GHSA-jvf4-g24p-2qgw Arbitrary Code Execution in shiba

HIGH Published 2021-05-10 Modified 2023-09-07 Official page ↗
Aliases
CVE-2020-7738
Ecosystem
npm
Packages
shiba
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Weaknesses
CWE-94
Reviewed
2021-04-22

Affected packages

• npm shiba: <= 1.2.1 (no fix yet)

Description

All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function `load()` of the package js-yaml instead of its secure replacement , `safeLoad()`.

Related

Alias · CVE (1)

  • CVE-2020-7738 All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load() of the package… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References