Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

GHSA-673q-mjm6-r5xr found in npm/[email protected]

Aperta Adatta ai principianti
  • Qualcosa non va?
#369 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
1/5
Tempo stimato
Meno di un'ora
Idoneità per principianti
78/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
next.js
Ambito
security

Direzione di ricerca

Il rapporto segnala [email protected] come vulnerabile e consiglia di aggiornare alla versione 16.4.1 o successiva. Inizia controllando nel manifest delle dipendenze e nel file di lock del repository quale versione di Next.js è installata. Poi aggiorna la dipendenza e verifica la versione registrata. Il lavoro è completato quando la dipendenza è almeno alla versione 16.4.1 e il rapporto sulle vulnerabilità non segnala più questa versione.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

cvss-severity:critical devguard l3montree-cybersecurity/.../devguard-documentation pkg:devguard/l3montree-c.../devguard-documentation pkg:oci/devguard-documen...ch=amd64&tag=main-amd64 risk:low state:open

GHSA-673q-mjm6-r5xr found in npm/[email protected]

[!important]
Risk: 3.40 (Low)
CVSS: 9.5

Description

Impact

A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays.

Workaround

There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.

Affected component

The vulnerability is in pkg:npm/[email protected], found in artifacts pkg:devguard/l3montree-cybersecurity/devguard/devguard-documentation, pkg:oci/devguard-documentation?repository_url=ghcr.io/l3montree-dev/devguard-documentation&arch=amd64&tag=main-amd64.

Recommended fix

Upgrade to version 16.4.1 or later.

# Update all vulnerable npm packages
npm audit fix
# Update only this package
npm install [email protected]
Additional guidance for mitigating vulnerabilities

Visit our guides on devguard.org

See more details...
Path to component
 %%{init: { 'theme':'base', 'themeVariables': {
'primaryColor': '#F3F3F3',
'primaryTextColor': '#0D1117',
'primaryBorderColor': '#999999',
'lineColor': '#999999',
'secondaryColor': '#ffffff',
'tertiaryColor': '#ffffff'
} }}%%
 flowchart TD
Your_application(["Your application"]) --- pkg_npm_next_16_3_8(["pkg:npm/next\@16.3.8"])

classDef default stroke-width:2px
Risk Factor Value Description
Vulnerability Depth 1 The vulnerability is in a direct dependency of your project.
EPSS 0.00 % The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.
EXPLOIT Not available We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database. There are no script kiddies exploiting this vulnerability.
CVSS-BE 9.0
CVSS-B 9.5 - The vulnerability can be exploited over the network without needing physical access.
- It is easy for an attacker to exploit this vulnerability.
- An attacker does not need any special privileges or access rights.
- No user interaction is needed for the attacker to exploit this vulnerability.

More details can be found in DevGuard

Interact with this vulnerability

You can use the following slash commands to interact with this vulnerability:

👍 Reply with this to acknowledge and accept the identified risk.
/accept I accept the risk of this vulnerability, because ...
⚠️ Mark the risk as false positive: Use one of these commands if you believe the reported vulnerability is not actually a valid issue.
/component-not-present The vulnerable component is not included in the artifact.

/vulnerable-code-not-present The component is present, but the vulnerable code is not included or compiled.

/vulnerable-code-not-in-execute-path The vulnerable code exists, but is never executed at runtime.

/vulnerable-code-cannot-be-controlled-by-adversary Built-in protections prevent exploitation of this vulnerability.

/inline-mitigations-already-exist The vulnerable code cannot be controlled or influenced by an attacker.
🔁 Reopen the risk: Use this command to reopen a previously closed or accepted vulnerability.
/reopen ...
Lingua principale
MDX
Stelle
8
Fork
4
Merge medio
3g 23h
PR unite (30g)
6

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di l3montree-dev/devguard-documentation

Tutte le issue di l3montree-dev/devguard-documentation

Issue simili

Altre issue su Security

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.