PT-2019-14325 · Eslint · Eslint-Utils

Mysticatea · Publicado 2019-08-26 · Atualizado 2020-08-24 · CVE-2019-15657

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eslint-utils versions 1.2.0 through 1.4.0

Description The issue concerns the execution of arbitrary code due to improper sanitization of user input by the getStaticValue function. This allows attackers to supply malicious input that executes arbitrary code during the linting process. The getStringIfConstant and getPropertyName functions are not affected.

Recommendations Upgrade to version 1.4.1 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2019-15657

GHSA-3GX7-XHV7-5MX3

Produtos afetados

Eslint-Utils

Referências · 9

• https://github.com/mysticatea/eslint-utils/security/advisories/GHSA-3gx7-xhv7-5mx3 · Nota
• https://github.com/mysticatea/eslint-utils · Nota
• https://github.com/mysticatea/eslint-utils/commit/08158db1c98fd71cf0f32ddefbc147e2620e724c · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-15657 · Nota de Segurança
• https://npmjs.com/advisories/1118 · Nota
• https://github.com/advisories/GHSA-3gx7-xhv7-5mx3 · Nota
• https://osv.dev/vulnerability/GHSA-3gx7-xhv7-5mx3 · Aviso do Fabricante
• https://eslint.org/blog/2019/08/eslint-v6.2.1-released · Nota
• https://osv.dev/vulnerability/CVE-2019-15657 · Aviso do Fabricante