saltcorn @saltcorn/plugins-loader vulnerabilities

Latest saltcorn @saltcorn/plugins-loader CVEs

Newest publication first

1. GHSA-fm76-w8jw-xf8m @saltcorn/plugins-loader unsanitized plugin name leads to a remote code execution (RCE) vulnerability when creating plugins using git source

   Published 2024-10-03

   High·CVSS 7.3

   Summary When creating a new plugin using the git source, the user-controlled value req.body.name is used to build the plugin directory where the location will be cloned. The API used to execute the git clone command with the user-controlled data is child_process.execSync. Since t...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.