Skip to content
OpenAdvisories

Package · npm

@saltcorn/plugins-loader

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • High 7.2
    GHSA-fm76-w8jw-xf8m

    @saltcorn/plugins-loader unsanitized plugin name leads to a remote code execution (RCE) vulnerability when creating plugins using git source

    ### Summary When creating a new plugin using the `git` source, the user-controlled value `req.body.name` is used to build the plugin directory where the location will be cloned. The API used to execute the `git clone` command with the user-controlled data is …

    @saltcorn/plugins-loader npm