What is GHSA-8f89-2fwj-5v5r?

GHSA-8f89-2fwj-5v5r is a security advisory published by GitHub Security Advisories with High severity. Improper Input Validation in klona

Which CVE IDs does GHSA-8f89-2fwj-5v5r cover?

GHSA-8f89-2fwj-5v5r covers the following CVE IDs: CVE-2020-8125. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8f89-2fwj-5v5r?

GHSA-8f89-2fwj-5v5r has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-8f89-2fwj-5v5r?

GHSA-8f89-2fwj-5v5r affects 1 product, including: npm/klona:\u003c= 1.1.0.

GHSA-8f89-2fwj-5v5rHighCVSS 9.8

Improper Input Validation in klona

Vendor

GitHub Security Advisories

Published

April 13, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-8125 →

📋 Description

Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using klona.

🎯 Affected products1

npm/klona:<= 1.1.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2020-8125
https://github.com/lukeed/klona/commit/200e8d1fd383a54790ee6fc8228264c21954e38e
https://hackerone.com/reports/778414
https://github.com/advisories/GHSA-8f89-2fwj-5v5r