What is GHSA-8gr3-2gjw-jj7g?

GHSA-8gr3-2gjw-jj7g is a security advisory published by GitHub Security Advisories with Low severity. Hidden functionality in node-ipc

Why does GHSA-8gr3-2gjw-jj7g have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-8gr3-2gjw-jj7g?

GHSA-8gr3-2gjw-jj7g affects 1 product, including: npm/node-ipc:= 9.2.2.

GHSA-8gr3-2gjw-jj7gLowDisclosed before NVD

Hidden functionality in node-ipc

Vendor

GitHub Security Advisories

Published

March 16, 2022

Last Modified

January 11, 2023

📋 Description

The package node-ipc version 9.2.2 is vulnerable to hidden functionality that was introduced by the maintainer. The package uses a dependency that writes a file to disk that does not pertain to the functionality of the package and is not included in versions < 9.2.2.

🎯 Affected products1

npm/node-ipc:= 9.2.2

🔗 References (2)

https://github.com/RIAEvangelist/node-ipc/releases/tag/9.2.2
https://github.com/advisories/GHSA-8gr3-2gjw-jj7g