What is GHSA-8g4m-cjm2-96wq?

GHSA-8g4m-cjm2-96wq is a security advisory published by GitHub Security Advisories with Medium severity. Sandbox escape in notevil and argencoders-notevil

Which CVE IDs does GHSA-8g4m-cjm2-96wq cover?

GHSA-8g4m-cjm2-96wq covers the following CVE IDs: CVE-2021-23771. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8g4m-cjm2-96wq?

GHSA-8g4m-cjm2-96wq has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-8g4m-cjm2-96wq?

GHSA-8g4m-cjm2-96wq affects 2 products, including: npm/notevil:\u003c= 1.3.3; npm/argencoders-notevil:\u003c= 2.5.0.

GHSA-8g4m-cjm2-96wqMediumCVSS 6.5

Sandbox escape in notevil and argencoders-notevil

Vendor

GitHub Security Advisories

Published

March 18, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2021-23771 →

📋 Description

This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an object's prototype. Note: This vulnerability derives from an incomplete fix in SNYK-JS-NOTEVIL-608878. This package has been deprecated.

🎯 Affected products2

npm/notevil:<= 1.3.3
npm/argencoders-notevil:<= 2.5.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2021-23771
https://snyk.io/vuln/SNYK-JS-ARGENCODERSNOTEVIL-2388587
https://snyk.io/vuln/SNYK-JS-NOTEVIL-2385946
https://github.com/advisories/GHSA-8g4m-cjm2-96wq