CRITICAL9.6

GHSA-mcvg-g9wx-v5vx

Valine code injection vulnerability

Quick fix

GHSA-mcvg-g9wx-v5vx — valine: upgrade to the fixed version with the command below.

npm install valine@1.5.0

Details

Valine was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST request.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/valine

Introduced in: 0Fixed in: 1.5.0

Fixnpm install valine@1.5.0

References

https://nvd.nist.gov/vuln/detail/CVE-2022-38545[ADVISORY]
https://github.com/xCss/Valine/issues/400[WEB]
https://github.com/xCss/Valine/commit/c40826c5816c98d797a6b1ed8b62bddf73ed4f65[WEB]
https://github.com/xCss/Valine[PACKAGE]
https://github.com/xCss/Valine/releases/tag/v1.5.0[WEB]