CRITICAL9.8

GHSA-vj95-2f9q-x7h6

glot-code-runner RCE

Details

The default configuration of glot-www through 2018-05-19 allows remote attackers to execute arbitrary code because glot-code-runner supports os.system within a "python" "files" "content" JSON file.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/prasmussen/glot-code-runner

Introduced in: 0

No fixed version published yet for github.com/prasmussen/glot-code-runner (go modules). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2018-15747[ADVISORY]
https://github.com/prasmussen/glot-code-runner/issues/15[WEB]
https://github.com/prasmussen/glot-code-runner[PACKAGE]