Description

This affects all versions of package calipso. It is possible for a malicious module to overwrite files on an arbitrary file system through the module install functionality.

Remediation

References

https://github.com/cliftonc/calipso

https://snyk.io/vuln/SNYK-JS-CALIPSO-1300555

Related Vulnerabilities

CVE-2020-6461 Vulnerability in npm package electron

CVE-2019-14862 Vulnerability in maven package org.webjars.npm:knockout

CVE-2018-1275 Vulnerability in maven package org.springframework:spring-messaging

CVE-2021-23354 Vulnerability in npm package printf

CVE-2020-7615 Vulnerability in npm package fsa

Severity

High

Classification

CWE-22 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Tags

Third Party Advisory Exploit