CVE-2022-0748 – post-loader

Package

Manager: npm
Name: post-loader
Vulnerable Version: >=0 <=2.0.0

Severity

Level: Critical

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS: 0.0114 pctl0.77606

Details

Arbitrary code execution in post-loader post-loader is webpack loader for blog posts written in Markdown. The package post-loader from 0.0.0 is vulnerable to Arbitrary Code Execution which uses a markdown parser in an unsafe way so that any javascript code inside the markdown input files gets evaluated and executed. At this time, there is no known workaround or patch available.

Metadata

Created: 2022-03-18T00:01:11Z
Modified: 2022-03-25T14:29:33Z
Source: MANUAL
CWE IDs: ["CWE-79"]
Alternative ID: GHSA-66ww-999q-mffq
Finding: F425
Auto approve: 1