Description

pixl-class prior to 1.0.3 allows execution of arbitrary commands. The members argument of the create function can be controlled by users without any sanitization.

Remediation

References

https://github.com/jhuckaby/pixl-class/commit/47677a3638e3583e42f3a05cc7f0b30293d2acc8

https://snyk.io/vuln/SNYK-JS-PIXLCLASS-564968

https://github.com/jhuckaby/pixl-class/commit/47677a3638e3583e42f3a05cc7f0b30293d2acc8%2C

Related Vulnerabilities

CVE-2023-0871 Vulnerability in maven package org.opennms.core:org.opennms.core.xml

CVE-2022-23107 Vulnerability in maven package io.jenkins.plugins:warnings-ng

CVE-2018-1288 Vulnerability in maven package org.apache.kafka:kafka

CVE-2022-21667 Vulnerability in npm package @soketi/soketi

CVE-2022-24802 Vulnerability in npm package deepmerge-ts

Severity

Critical

Classification

CWE-78 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Patch Third Party Advisory