GHSA-hw46-vg6w-88fj

replicator vulnerable to Deserialization of Untrusted Data

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-33420

Packages

Ecosystem	Package	Affected	Fixed in
npm	replicator	< 1.0.4	1.0.4

Details

As written in the advisory (Markdown source, shown as plain text).

A deserialization issue discovered in inikulin replicator before 1.0.4 allows remote attackers to run arbitrary code via the fromSerializable function in TypedArray object.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-33420 advisory
https://github.com/inikulin/replicator/issues/16 web
https://github.com/inikulin/replicator/pull/17 web
https://github.com/inikulin/replicator/commit/2c626242fb4a118855262c64b5731b2ce98e521b web
https://advisory.checkmarx.net/advisory/CX-2021-4787 web
https://github.com/inikulin/replicator package