GHSA-gg6x-448q-pqqm

Avenwu Whistle Cross-Site Request Forgery (CSRF)

Source: GitHub Advisory Database (reviewed) High CVE-2024-55500

Packages

Ecosystem	Package	Affected	Fixed in
npm	whistle	<= 2.9.90	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Cross-Site Request Forgery (CSRF) in Avenwu Whistle v.2.9.90 and before allows attackers to perform malicious API calls, resulting in the execution of arbitrary code on the victim's machine.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-55500 advisory
https://github.com/avwo/whistle/commit/d1b8ca275dc4e453bd2efed392c0fd4b92f73cdf web
https://github.com/avwo/whistle package
https://www.sonarsource.com/blog/never-underestimate-csrf-why-origin-reflection-is-a-bad-idea web