Code injection issue for java-spring-cloud-stream-template

The following was initially reported by @jonaslagoni: Given the following command: ag ./dummy.json @asyncapi/java-spring-cloud-stream-template --force-write --output ./output With the following AsyncAPI document: json "asyncapi": "2.0.0", "info": "title": "Streetlight", "version": "1.0.0" ,...

PT-2021-21814

Name of the Vulnerable Software and Affected Versions @asyncapi/java-spring-cloud-stream-template versions prior to 0.7.0 Description The issue allows for arbitrary code injection when an attacker controls the AsyncAPI document. This can be achieved by manipulating the operationId field in the...