PT-2019-20002 · Unknown · Constantinople

Published 2019-06-14 · Updated 2019-06-14

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions constantinople versions prior to 3.1.1

Description The issue concerns a sandbox bypass that can lead to arbitrary code execution.

Recommendations Update to version 3.1.1 or later.

Fix

Related Identifiers

GHSA-4VMM-MHCQ-4X9J

Affected Products

Constantinople

References · 5

• https://osv.dev/vulnerability/GHSA-4vmm-mhcq-4x9j · Vendor Advisory
• https://github.com/pugjs/constantinople/commit/01d409c0d081dfd65223e6b7767c244156d35f7f · Note
• https://snyk.io/vuln/npm:constantinople:20180421 · Note
• https://npmjs.com/advisories/568 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1577703 · Note