PT-2022-26067 · Nako3Edit · Nako3Edit

Satoki Tsuji · Published 2022-12-05 · Updated 2025-04-24 · CVE-2022-41777

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Nako3edit versions 3.3.74 and earlier

Description The issue is related to an improper check or handling of exceptional conditions in the Nako3edit component, which is part of the Nadeshiko 3 programming language. This allows a remote attacker to inject an invalid value into the decodeURIComponent function of Nako3edit. As a result, the server may crash.

Recommendations For versions 3.3.74 and earlier, consider disabling the decodeURIComponent function in Nako3edit as a temporary workaround until a patch is available. Restrict access to the Nako3edit component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

CWE-703

Related Identifiers

CVE-2022-41777

GHSA-X2JX-W3WM-9P3P

Affected Products

Nako3Edit

References · 9

• https://github.com/kujirahand/nadesiko3/issues/1325 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-41777 · Security Note
• https://osv.dev/vulnerability/GHSA-x2jx-w3wm-9p3p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41777 · Vendor Advisory
• https://github.com/kujirahand/nadesiko3/issues/1347 · Note
• https://github.com/kujirahand/nadesiko3 · Note
• https://github.com/kujirahand/nadesiko3/releases/tag/3.3.75 · Note
• https://t.me/cvenotify/119677 · Telegram Post
• https://jvn.jp/en/jp/JVN56968681/index.html · Note