CVE-2020-8125 Improper Input Validation in klona
Prototype pollution in the klona npm library allows attackers to achieve remote code execution or cause denial of service in applications using the package.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-8125?
CVE-2020-8125 is a critical code injection vulnerability in klona npm module, published on 4 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using klona.
Weakness: CWE-20
Which versions are affected by CVE-2020-8125?
2 open source packages ship an affected version, including klona. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
klona npm | All versions | 1.1.1 |
klona npm | All versions | 1.1.1 |
Products include Klona Project Klona.
How do I fix CVE-2020-8125?
Upgrade klona to 1.1.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-8125 being exploited?
There is no known exploitation of CVE-2020-8125 in the wild and no public exploit code.
Sources
Also known as GHSA-8f89-2fwj-5v5r.