GitHub Advisoryadvisory · npm

GHSA-r83x-wj75-v89r Nuclide Improper Input Validation

CRITICAL Published 2022-05-13 Modified 2023-07-21 Official page ↗
Aliases
CVE-2018-6333
Ecosystem
npm
Packages
nuclide
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20, CWE-79
Reviewed
2023-07-21

Affected packages

• npm nuclide: < 0.290.0 → fixed in 0.290.0

Description

The hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering. As a result, a malicious URL could be used to render HTML and other content inside of the editor's context, which could potentially be chained to lead to code execution. This issue affected Nuclide prior to v0.290.0.

Related

Alias · CVE (1)

  • CVE-2018-6333 The hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References