GHSA-jvf4-g24p-2qgwHighCVSS 8.3

Arbitrary Code Execution in shiba

Published
May 10, 2021
Last Modified
September 7, 2023

🔗 CVE IDs covered (1)

CVE-2020-7738 →

📋 Description

All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load() of the package js-yaml instead of its secure replacement , safeLoad().

🎯 Affected products1

  • npm/shiba:<= 1.2.1

🔗 References (4)