GitHub Advisoryadvisory · npm

GHSA-jxcc-g75x-qgw9 Calipso Arbitrary File Write via Archive Extraction (Zip Slip)

HIGH Published 2021-06-08 Modified 2023-09-07 Official page ↗
Aliases
CVE-2021-23391
Ecosystem
npm
Packages
calipso
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Weaknesses
CWE-29, CWE-668
Reviewed
2021-06-08

Affected packages

• npm calipso: <= 0.3.54 (no fix yet)

Description

This affects all versions of package calipso. It is possible for a malicious module to overwrite files on an arbitrary file system through the module install functionality.

Related

Alias · CVE (1)

  • CVE-2021-23391 This affects all versions of package calipso. vulnerability

Weakness · CWE (2)

  • CWE-29 Path Traversal: '\..\filename' weakness
  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References