saltcorn @saltcorn/cli vulnerabilities

Latest saltcorn @saltcorn/cli CVEs

Newest publication first

1. GHSA-wxf3-4fvj-vqqx Unsafe plugins can be installed via pack import by tenant admins

   Published 2023-07-27

   High·CVSS 8.7

   Summary Unsafe plugins (for instance sql-list) can be installed in subdomain tenants via pack import even if unsafe plugin installation for tenants is disables Details I have an example https://bot20230704.saltcorn.com/view/all_plugins It's publicly accessible (but has not so sec...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.