What is GHSA-xf27-jqwv-gf3r?

GHSA-xf27-jqwv-gf3r is a security advisory published by GitHub Security Advisories with High severity. Unintended Require in larvitbase-api

Which CVE IDs does GHSA-xf27-jqwv-gf3r cover?

GHSA-xf27-jqwv-gf3r covers the following CVE IDs: CVE-2019-5479. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xf27-jqwv-gf3r?

GHSA-xf27-jqwv-gf3r has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-xf27-jqwv-gf3r?

GHSA-xf27-jqwv-gf3r affects 1 product, including: npm/larvitbase-api:\u003c 0.5.5.

GHSA-xf27-jqwv-gf3rHighCVSS 7.5

Unintended Require in larvitbase-api

Vendor

GitHub Security Advisories

Published

September 11, 2019

Last Modified

September 11, 2023

🔗 CVE IDs covered (1)

CVE-2019-5479 →

📋 Description

Versions of larvitbase-api prior to 0.5.4 are vulnerable to an Unintended Require. The package exposes an API endpoint and passes a GET parameter unsanitized to an require() call. This allows attackers to execute any .js file in the same folder as the server is running.

Recommendation

Upgrade to version 0.5.4 or later.

🎯 Affected products1

npm/larvitbase-api:< 0.5.5

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2019-5479
https://hackerone.com/reports/566056
https://www.npmjs.com/advisories/1120
https://github.com/advisories/GHSA-xf27-jqwv-gf3r