What is GHSA-qc22-qwm9-j8rx?

GHSA-qc22-qwm9-j8rx is a security advisory published by GitHub Security Advisories with Critical severity. Remote Code Execution in npm-groovy-lint

Why does GHSA-qc22-qwm9-j8rx have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-qc22-qwm9-j8rx?

GHSA-qc22-qwm9-j8rx affects 1 product, including: npm/npm-groovy-lint:\u003c 9.1.0.

GHSA-qc22-qwm9-j8rxCriticalDisclosed before NVD

Remote Code Execution in npm-groovy-lint

Vendor

GitHub Security Advisories

Published

December 20, 2021

Last Modified

January 11, 2023

📋 Description

Versions of npm-groovy-lint prior to 9.1.0 bundle vulnerable versions of the Log4j library which are subject to remote code execution via jndi rendering. As a result npm-groovy-lint prior to 9.1.0 is also vulnerable.

🎯 Affected products1

npm/npm-groovy-lint:< 9.1.0

🔗 References (5)

https://github.com/nvuillam/npm-groovy-lint/issues/194
https://github.com/nvuillam/npm-groovy-lint/pull/195
https://github.com/nvuillam/npm-groovy-lint/commit/0b664519019442052e0190170c2b1c5aff7d72e7
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://github.com/advisories/GHSA-qc22-qwm9-j8rx