~ / search / GHSA-2gc6-2h2g-ph48

GHSA-2gc6-2h2g-ph48

Rambox RCE Vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-17625

Packages

EcosystemPackageAffectedFixed in
npm Rambox <= 0.6.9 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron, such as an exec of OS commands within the onerror attribute of an IMG element.

References

External links from the advisory. They lead to third-party sites.