What is GHSA-4vmm-mhcq-4x9j?

GHSA-4vmm-mhcq-4x9j is a security advisory published by GitHub Security Advisories with Critical severity. Sandbox Bypass Leading to Arbitrary Code Execution in constantinople

Why does GHSA-4vmm-mhcq-4x9j have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-4vmm-mhcq-4x9j?

GHSA-4vmm-mhcq-4x9j has a CVSS v3 base score of 10.0, published by GitHub Security Advisories.

Which products are affected by GHSA-4vmm-mhcq-4x9j?

GHSA-4vmm-mhcq-4x9j affects 1 product, including: npm/constantinople:\u003c 3.1.1.

GHSA-4vmm-mhcq-4x9jCriticalCVSS 10.0Disclosed before NVD

Sandbox Bypass Leading to Arbitrary Code Execution in constantinople

Vendor

GitHub Security Advisories

Published

June 14, 2019

Last Modified

January 9, 2023

📋 Description

Versions of constantinople prior to 3.1.1 are vulnerable to a sandbox bypass which can lead to arbitrary code execution.

Recommendation

Update to version 3.1.1 or later.

🎯 Affected products1

npm/constantinople:< 3.1.1

🔗 References (5)

https://github.com/pugjs/constantinople/commit/01d409c0d081dfd65223e6b7767c244156d35f7f
https://bugzilla.redhat.com/show_bug.cgi?id=1577703
https://www.npmjs.com/advisories/568
https://snyk.io/vuln/npm:constantinople:20180421
https://github.com/advisories/GHSA-4vmm-mhcq-4x9j