{"answers":{"affected":"2 open source packages ship an affected version, including @saltcorn/server.","exploited":"There is no known exploitation of GHSA-cr3w-cw5w-h3fj in the wild and no public exploit code.","fix":"Upgrade @saltcorn/server to 1.5.0-beta.19 or later.","what":"GHSA-cr3w-cw5w-h3fj is a command injection vulnerability in @saltcorn/server, published on 26 Jan 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-cr3w-cw5w-h3fj and fix it if it is affected.\n\nWhat it is: GHSA-cr3w-cw5w-h3fj is a command injection vulnerability in @saltcorn/server, published on 26 Jan 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-cr3w-cw5w-h3fj in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- @saltcorn/server (npm): affected from 1.1.1; fixed in 1.5.0-beta.19\n- @saltcorn/server (npm): affected from 1.1.1; fixed in 1.5.0-beta.19\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-cr3w-cw5w-h3fj/ (Markdown: https://insights.sbomify.com/GHSA-cr3w-cw5w-h3fj/index.md)","id":"GHSA-cr3w-cw5w-h3fj","markdown":"https://insights.sbomify.com/GHSA-cr3w-cw5w-h3fj/index.md","name":"GHSA-cr3w-cw5w-h3fj","record":{"aliases":[],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["code_execution","account_takeover"],"network_reachable":"yes","non_default_config":false,"product_category":"Saltcorn web application","requires_auth":"high_privilege","summary":"Chained reflected XSS and command injection allow attackers to execute arbitrary shell commands if an admin clicks a malicious link.","user_interaction":"required","vuln_class":"command_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\n1. There is a reflected XSS vulnerability in the GET /admin/edit-codepage/:name route through the name parameter. This can be used to hijack the session of an admin if they click a specially crafted link.\n2. Additionally, there is a Command Injection vulnerability in GET /admin/backup. The admin can inject a shell command in the backup password which is inserted in the command used to create the backup zip.\n\nBoth vulnerabilities can be chained to craft a malicious link which will execute an arbitrary shell command on the server if it is clicked by a saltcorn admin with an active session. I believe iframes could also be used to exploit this silently when the admin visits an attacker-controlled web page (though I have not tested that).\n\n### Details\n1. The XSS vulnerability is here: https://github.com/saltcorn/saltcorn/blob/020893c0001678fd5ebd2c088ba68b395de1aabc/packages/server/routes/admin.js#L4886-L4887 Specifically, the name parameter is inserted into the pages breadcrumbs without sanitization.\n2. The Command Injection happens here: https://github.com/saltcorn/saltcorn/blob/020893c0001678fd5ebd2c088ba68b395de1aabc/packages/saltcorn-admin-models/models/backup.ts#L381-L382\n\n### PoC\n1. A minimal PoC for the XSS can be as simple as: http://localhost:3000/admin/edit-codepage/%3Cimg%20src%3Dx%20onerror%3Dalert%281%29%3E%0A (assuming saltcorn running at localhost:3000 and the user having an active admin session)\n2. For the Command Injection, visit the backup section of saltcorn, set an admin password like `\";$(whoami);\"` (including the quotation marks) and then click \"Download a backup\" in the \"Manual backup\" section. This should display an error page saying that /bin/sh could not find the binary named \"root\" or \"saltcorn\", depending on the user.\n\nAn example of an exploit that chains both vulnerabilities and generates the aforementioned malicious link:\n[exploit.zip](https://github.com/user-attachments/files/24356819/exploit.zip)\n\n### Affected Versions\nEdit: The following Docker containers from docker hub were tested: 1.4.1, 1.4.0, 1.3.1, 1.3.0, 1.2.0, 1.1.2, 1.1.1, 1.0.0\nThe Command Injection is applicable to versions \u003e= 1.3.0.\nThe XSS is applicable to versions \u003e= 1.1.1","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE","id":"GHSA-cr3w-cw5w-h3fj","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"command_injection","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["1.5.0-beta.19"],"introduced":["1.1.1"],"last_affected":[],"package":"@saltcorn/server","purl":null,"source":"GHSA-cr3w-cw5w-h3fj"},{"ecosystem":"npm","fixed":["1.5.0-beta.19"],"introduced":["1.1.1"],"last_affected":[],"package":"@saltcorn/server","purl":"pkg:npm/%40saltcorn/server","source":"GHSA-cr3w-cw5w-h3fj"}],"products":null,"published":"2026-01-26","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Chained reflected XSS and command injection allow attackers to execute arbitrary shell commands if an admin clicks a malicious link.","url":"https://insights.sbomify.com/GHSA-cr3w-cw5w-h3fj/"}