GHSA-vh2g-6c4x-5hmp

Path traversal and code execution via prototype vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-26045

Packages

Ecosystem	Package	Affected	Fixed in
npm	nodebb	>= 2.5.0, < 2.8.7	2.8.7

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Due to the use of the [object destructuring assignment](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Destructuring_assignment) syntax in the user export code path, combined with a path traversal vulnerability, a specially crafted payload could invoke the user export logic to arbitrarily execute javascript files on the local disk. ### Patches Patched in v2.8.7 ### Workarounds Site maintainers can cherry pick ec58700f6dff8e5b4af1544f6205ec362b593092 into their codebase to patch the exploit.

References

External links from the advisory. They lead to third-party sites.

https://github.com/NodeBB/NodeBB/security/advisories/GHSA-vh2g-6c4x-5hmp web
https://nvd.nist.gov/vuln/detail/CVE-2023-26045 advisory
https://github.com/NodeBB/NodeBB/commit/ec58700f6dff8e5b4af1544f6205ec362b593092 web
https://github.com/NodeBB/NodeBB package
https://security.netapp.com/advisory/ntap-20230831-0004 web