Skip to content
OpenAdvisories
Critical · 9.8 CVE-2018-3784 EUVD-2018-0359GHSA-38f5-ghc2-fcmv

Code Injection in cryo

Published Aug 17, 2018 · Updated Aug 5, 2024 · Assigned by hackerone

Vendor: https://github.com/hunterloftis Product: cryo Package: cryo Ecosystem: npm

Description

A code injection in cryo 0.0.6 allows an attacker to arbitrarily execute code due to insecure implementation of deserialization.

Affected products

VendorProductAffectedFixed
https://github.com/hunterloftis cryo Not fixed —

Affected packages

EcosystemPackageAffectedFixedRecord
npm cryo <= 0.0.6 — GHSA-38f5-ghc2-fcmv

References