MEDIUM5.3

GHSA-x2jx-w3wm-9p3p

nadesiko3 allows remote attacker to inject invalid value to decodeURIComponent of nako3edit

Quick fix

GHSA-x2jx-w3wm-9p3p — nadesiko3: upgrade to the fixed version with the command below.

npm install nadesiko3@3.3.75

Details

Nako3edit is the editor component of Nadeshiko 3, a programming language developed based on Japanese. Improper check or handling of exceptional conditions in Nako3edit v3.3.74 and earlier allows a remote attacker to inject an invalid value to decodeURIComponent of nako3edit, which may lead the server to crash.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/nadesiko3

Introduced in: 0Fixed in: 3.3.75

Fixnpm install nadesiko3@3.3.75

References

https://nvd.nist.gov/vuln/detail/CVE-2022-41777[ADVISORY]
https://github.com/kujirahand/nadesiko3/issues/1325[WEB]
https://github.com/kujirahand/nadesiko3/issues/1347[WEB]
https://github.com/kujirahand/nadesiko3[PACKAGE]
https://github.com/kujirahand/nadesiko3/releases/tag/3.3.75[WEB]
https://jvn.jp/en/jp/JVN56968681/index.html[WEB]