PT-2020-21097 · Unknown · Cicada-Render

Published 2020-09-03 · Updated 2020-09-03

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cicada-render versions (affected versions not specified)

Description The issue concerns malicious code in the cicada-render package, which uploads system information to a remote server, downloads a file, and executes it. Any computer with this package installed or running should be considered fully compromised.

Recommendations Remove the cicada-render package. Rotate all secrets and keys stored on the compromised computer immediately from a different computer. Consider the computer fully compromised and take appropriate measures to address potential malicious software installed as a result of the package.

Fix

RCE

Weakness Enumeration

CWE-506

Related Identifiers

GHSA-6M6M-J2HM-PXRG

Affected Products

Cicada-Render

References · 2

• https://osv.dev/vulnerability/GHSA-6m6m-j2hm-pxrg · Vendor Advisory
• https://npmjs.com/advisories/1051 · Note