GHSA-4vmm-mhcq-4x9j Sandbox Bypass Leading to Arbitrary Code Execution in constantinople
An attacker can bypass the sandbox in the constantinople library to execute arbitrary code on the host system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-4vmm-mhcq-4x9j?
GHSA-4vmm-mhcq-4x9j is a code injection vulnerability in constantinople, published on 14 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of constantinople prior to 3.1.1 are vulnerable to a sandbox bypass which can lead to arbitrary code execution.
Recommendation
Update to version 3.1.1 or later.
Which versions are affected by GHSA-4vmm-mhcq-4x9j?
2 open source packages ship an affected version, including constantinople.
| Package | Affected | Fixed in |
|---|---|---|
constantinople npm | All versions | 3.1.1 |
constantinople npm | All versions | 3.1.1 |
How do I fix GHSA-4vmm-mhcq-4x9j?
Upgrade constantinople to 3.1.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is GHSA-4vmm-mhcq-4x9j being exploited?
There is no known exploitation of GHSA-4vmm-mhcq-4x9j in the wild and no public exploit code.