GitHub Advisoryadvisory · npm

GHSA-xf27-jqwv-gf3r Unintended Require in larvitbase-api

HIGH Published 2019-09-11 Modified 2023-09-11 Official page ↗
Aliases
CVE-2019-5479
Ecosystem
npm
Packages
larvitbase-api
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-829
Reviewed
2019-09-04

Affected packages

• npm larvitbase-api: < 0.5.5 → fixed in 0.5.5

Description

Versions of `larvitbase-api` prior to 0.5.4 are vulnerable to an Unintended Require. The package exposes an API endpoint and passes a GET parameter unsanitized to an `require()` call. This allows attackers to execute any `.js` file in the same folder as the server is running. Recommendation Upgrade to version 0.5.4 or later.

Related

Alias · CVE (1)

  • CVE-2019-5479 An unintended require vulnerability in <v0.5.5 larvitbase-api may allow an attacker to load arbitrary non-production code (JavaScript file). vulnerability

Weakness · CWE (1)

  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere weakness

References