What is GHSA-mh6f-8j2x-4483?

GHSA-mh6f-8j2x-4483 is a security advisory published by GitHub Security Advisories with Critical severity. Critical severity vulnerability that affects event-stream and flatmap-stream

Why does GHSA-mh6f-8j2x-4483 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-mh6f-8j2x-4483?

GHSA-mh6f-8j2x-4483 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-mh6f-8j2x-4483?

GHSA-mh6f-8j2x-4483 affects 2 products, including: npm/event-stream:= 3.3.6; npm/flatmap-stream:\u003e= 0.

GHSA-mh6f-8j2x-4483CriticalCVSS 9.8Disclosed before NVD

Critical severity vulnerability that affects event-stream and flatmap-stream

Vendor

GitHub Security Advisories

Published

November 26, 2018

Last Modified

January 12, 2023

📋 Description

The NPM package flatmap-stream is considered malicious. A malicious actor added this package as a dependency to the NPM event-stream package in version 3.3.6. Users of event-stream are encouraged to downgrade to the last non-malicious version, 3.3.4, or upgrade to the latest 4.x version.

Users of flatmap-stream are encouraged to remove the dependency entirely.

🎯 Affected products2

npm/event-stream:= 3.3.6
npm/flatmap-stream:>= 0

🔗 References (2)

https://github.com/dominictarr/event-stream/issues/116
https://github.com/advisories/GHSA-mh6f-8j2x-4483