GHSA-82gw-pqf7-q3j2

pym.js CSRF Vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2018-1000086

Packages

Ecosystem	Package	Affected	Fixed in
npm	pym.js	>= 0.4.2, < 1.3.2	1.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

NPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 contains a Cross Site Request Forgery (CSRF) vulnerability in Pym.js `_onNavigateToMessage` function. https://github.com/nprapps/pym.js/blob/master/src/pym.js#L573 can result in Arbitrary javascript code execution. This attack appears to be exploitable if the Attacker gains full javascript access to pages with Pym.js embeds, or when user visits an attacker-crafted page. This vulnerability appears to have been fixed in versions 1.3.2 and later.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1000086 advisory
https://github.com/nprapps/pym.js/issues/170 web
https://github.com/nprapps/pym.js/commit/c3552a6cf2532664c17bd6a318fb3cf8e4cf2f97 web
https://github.com/advisories/GHSA-82gw-pqf7-q3j2 advisory
https://github.com/nprapps/pym.js package
http://blog.apps.npr.org/2018/02/15/pym-security-vulnerability.html web