GHSA-673q-mjm6-r5xr found in npm/[email protected]
还没有人认领这个 Issue。
评估
- 难度
- 1/5
- 预计耗时
- 1 小时以内
- 新手友好度
- 78/100
- Issue 类型
- 缺陷
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 技术栈
- next.js
- 领域
- security
调研方向
报告指出 [email protected] 存在漏洞，并建议升级到 16.4.1 或更高版本。首先检查仓库的包清单和锁定文件，确认已安装的 Next.js 版本，然后更新依赖项并验证记录的版本。依赖项至少达到 16.4.1，且漏洞报告不再指出此版本时，即表示完成。
由索引模型根据 Issue 内容生成。
描述
GHSA-673q-mjm6-r5xr found in npm/[email protected]
[!important]
Risk:3.40 (Low)
CVSS:9.5
Description
Impact
A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays.
Workaround
There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.
Affected component
The vulnerability is in pkg:npm/[email protected], found in artifacts pkg:devguard/l3montree-cybersecurity/devguard/devguard-documentation, pkg:oci/devguard-documentation?repository_url=ghcr.io/l3montree-dev/devguard-documentation&arch=amd64&tag=main-amd64.
Recommended fix
Upgrade to version 16.4.1 or later.
# Update all vulnerable npm packages
npm audit fix
# Update only this package
npm install [email protected]
Additional guidance for mitigating vulnerabilities
Visit our guides on devguard.org
See more details...
Path to component
%%{init: { 'theme':'base', 'themeVariables': {
'primaryColor': '#F3F3F3',
'primaryTextColor': '#0D1117',
'primaryBorderColor': '#999999',
'lineColor': '#999999',
'secondaryColor': '#ffffff',
'tertiaryColor': '#ffffff'
} }}%%
flowchart TD
Your_application(["Your application"]) --- pkg_npm_next_16_3_8(["pkg:npm/next\@16.3.8"])
classDef default stroke-width:2px
| Risk Factor | Value | Description |
|---|---|---|
| Vulnerability Depth | 1 |
The vulnerability is in a direct dependency of your project. |
| EPSS | 0.00 % |
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days. |
| EXPLOIT | Not available |
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database. There are no script kiddies exploiting this vulnerability. |
| CVSS-BE | 9.0 |
|
| CVSS-B | 9.5 |
- The vulnerability can be exploited over the network without needing physical access. - It is easy for an attacker to exploit this vulnerability. - An attacker does not need any special privileges or access rights. - No user interaction is needed for the attacker to exploit this vulnerability. |
More details can be found in DevGuard
Interact with this vulnerability
You can use the following slash commands to interact with this vulnerability:
👍 Reply with this to acknowledge and accept the identified risk.
/accept I accept the risk of this vulnerability, because ...
⚠️ Mark the risk as false positive: Use one of these commands if you believe the reported vulnerability is not actually a valid issue.
/component-not-present The vulnerable component is not included in the artifact.
/vulnerable-code-not-present The component is present, but the vulnerable code is not included or compiled.
/vulnerable-code-not-in-execute-path The vulnerable code exists, but is never executed at runtime.
/vulnerable-code-cannot-be-controlled-by-adversary Built-in protections prevent exploitation of this vulnerability.
/inline-mitigations-already-exist The vulnerable code cannot be controlled or influenced by an attacker.
🔁 Reopen the risk: Use this command to reopen a previously closed or accepted vulnerability.
/reopen ...
- 主要语言
- MDX
- 星标
- 8
- 派生
- 4
- 平均合并
- 3 天 23 小时
- 30 天内合并 PR
- 6
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
l3montree-dev/devguard-documentation 的其他 Issue
-
cvss-severity:high devguard l3montree-cybersecurity/.../devguard-documentation pkg:devguard/l3montree-c.../devguard-documentation pkg:oci/devguard-documen...ch=amd64&tag=main-amd64 risk:low state:open
难度 1/5 1-3 小时 新手友好度 64/100
l3montree-dev/devguard-documentation#372 · 1 条评论 ·
-
cvss-severity:critical devguard l3montree-cybersecurity/.../devguard-documentation pkg:devguard/l3montree-c.../devguard-documentation pkg:oci/devguard-documen...ch=amd64&tag=main-amd64 risk:low state:open
难度 1/5 1 小时以内 新手友好度 68/100
l3montree-dev/devguard-documentation#371 · 1 条评论 ·
-
cvss-severity:high devguard l3montree-cybersecurity/.../devguard-documentation pkg:oci/devguard-documen...ch=amd64&tag=main-amd64 risk:low state:open
难度 1/5 1 小时以内 新手友好度 75/100
l3montree-dev/devguard-documentation#365 · 1 条评论 ·
-
cvss-severity:high devguard l3montree-cybersecurity/.../devguard-documentation pkg:devguard/l3montree-c.../devguard-documentation risk:low state:open
难度 1/5 1 小时以内 新手友好度 82/100
l3montree-dev/devguard-documentation#358 · 1 条评论 ·
-
cvss-severity:high devguard l3montree-cybersecurity/.../devguard-documentation pkg:devguard/l3montree-c.../devguard-documentation risk:low state:open
难度 1/5 1 小时以内 新手友好度 65/100
l3montree-dev/devguard-documentation#355 · 1 条评论 ·
查看 l3montree-dev/devguard-documentation 的全部 Issue
相似的 Issue
-
难度 1/5 1 小时以内 新手友好度 78/100
pypa/advisory-database#412 ·
维护者通常 1 天内回复
-
refactor
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
good first issue security
难度 2/5 1-3 小时 新手友好度 82/100
-
blocklist addition
难度 1/5 1 小时以内 新手友好度 79/100
MetaMask/eth-phishing-detect#306847 ·
维护者通常 1 天内回复
-
agent-ready area:cli bug p3 security
难度 2/5 1-3 小时 新手友好度 66/100
gacela-project/gacela#1014 ·
维护者通常 1 天内回复