What is GHSA-vj95-2f9q-x7h6?

GHSA-vj95-2f9q-x7h6 is a security advisory published by GitHub Security Advisories with Critical severity. glot-code-runner RCE

Which CVE IDs does GHSA-vj95-2f9q-x7h6 cover?

GHSA-vj95-2f9q-x7h6 covers the following CVE IDs: CVE-2018-15747. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vj95-2f9q-x7h6?

GHSA-vj95-2f9q-x7h6 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-vj95-2f9q-x7h6?

GHSA-vj95-2f9q-x7h6 affects 1 product, including: go/github.com/prasmussen/glot-code-runner:\u003c= 2018-05-19.

GHSA-vj95-2f9q-x7h6CriticalCVSS 9.8

glot-code-runner RCE

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

July 19, 2023

🔗 CVE IDs covered (1)

CVE-2018-15747 →

📋 Description

The default configuration of glot-www through 2018-05-19 allows remote attackers to execute arbitrary code because glot-code-runner supports os.system within a "python" "files" "content" JSON file.

🎯 Affected products1

go/github.com/prasmussen/glot-code-runner:<= 2018-05-19

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2018-15747
https://github.com/prasmussen/glot-code-runner/issues/15
https://github.com/advisories/GHSA-vj95-2f9q-x7h6