by Kastro
Paper/Archive/CVE-2022-0748

CVE-2022-0748

snyk — Arbitrary Code Execution

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 81.6.816 × 2016.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The package post-loader from 0.0.0 are vulnerable to Arbitrary Code Execution which uses a markdown parser in an unsafe way so that any javascript code inside the markdown input files gets evaluated and executed.

Affected

ProductAffectedFixed inSource
post-loader0.0.0 – < unspecifiedunspecifiedCNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
snyk (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refsnyk.io/vuln/SNYK-JS-POSTLOADER-2403737