Description

Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST request.

Remediation

References

https://github.com/xCss/Valine/issues/400

Related Vulnerabilities

CVE-2020-7763 Vulnerability in npm package phantom-html-to-pdf

CVE-2018-14042 Vulnerability in maven package org.fujion.webjars:bootstrap

CVE-2020-28267 Vulnerability in npm package @strikeentco/set

CVE-2018-3728 Vulnerability in maven package org.webjars.npm:hoek

CVE-2021-25946 Vulnerability in npm package nconf-toml

Severity

Critical

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Tags

Exploit Issue Tracking Third Party Advisory