~ / search / GHSA-r83x-wj75-v89r

GHSA-r83x-wj75-v89r

Nuclide Improper Input Validation

Source: GitHub Advisory Database (reviewed) Critical CVE-2018-6333

Packages

EcosystemPackageAffectedFixed in
npm nuclide < 0.290.0 0.290.0

Details

As written in the advisory (Markdown source, shown as plain text).

The hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering. As a result, a malicious URL could be used to render HTML and other content inside of the editor's context, which could potentially be chained to lead to code execution. This issue affected Nuclide prior to v0.290.0.

References

External links from the advisory. They lead to third-party sites.