GHSA-mh6f-8j2x-4483 Critical severity vulnerability that affects event-stream and flatmap-stream
A malicious dependency in the event-stream npm package allows attackers to execute arbitrary code on systems using the affected library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-mh6f-8j2x-4483?
GHSA-mh6f-8j2x-4483 is a vulnerability in event-stream, published on 26 Nov 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The NPM package flatmap-stream is considered malicious. A malicious actor added this package as a dependency to the NPM event-stream package in version 3.3.6. Users of event-stream are encouraged to downgrade to the last non-malicious version, 3.3.4, or upgrade to the latest 4.x version.
Users of flatmap-stream are encouraged to remove the dependency entirely.
Which versions are affected by GHSA-mh6f-8j2x-4483?
4 open source packages ship an affected version, including event-stream and flatmap-stream.
| Package | Affected | Fixed in |
|---|---|---|
event-stream npm | From 3.3.6 | 4.0.0 |
event-stream npm | From 3.3.6 | 4.0.0 |
flatmap-stream npm | All versions | None |
flatmap-stream npm | All versions | None |
How do I fix GHSA-mh6f-8j2x-4483?
Upgrade event-stream to 4.0.0 or later.
Is GHSA-mh6f-8j2x-4483 being exploited?
There is no known exploitation of GHSA-mh6f-8j2x-4483 in the wild and no public exploit code.