GitHub Advisoryadvisory · npm

GHSA-xrr6-6ww3-f3qm Sandbox Breakout / Arbitrary Code Execution in value-censorship

MEDIUM Published 2020-09-02 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
value-censorship
Severity
Moderate
Reviewed
2020-08-31

Affected packages

• npm value-censorship: all versions (no fix yet)

Description

All versions of `value-censorship` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to validate async function constructors allowing attackers to execute arbitrary code. Recommendation No fix is currently available. Consider using an alternative package until a fix is made available.

References