GHSA-xf27-jqwv-gf3r
Unintended Require in larvitbase-api
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | larvitbase-api | < 0.5.5 | 0.5.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
Versions of `larvitbase-api` prior to 0.5.4 are vulnerable to an Unintended Require. The package exposes an API endpoint and passes a GET parameter unsanitized to an `require()` call. This allows attackers to execute any `.js` file in the same folder as the server is running.
## Recommendation
Upgrade to version 0.5.4 or later.
References
External links from the advisory. They lead to third-party sites.