WS-2018-0152

The funcster npm module version 0.0.3 and lower, allows remote code execution during deserialization of JSON...

albot (>=0.12.0, <=0.14.1), background-functions (>=1.0.0, <=1.0.4) +2 more potentially affected by unknown CVE via funcster (>=0.0.2, <=0.0.3)

funcster NPM version =0.0.2, =0.12.0, =1.0.0, =0.5.3, =0.0.1, =0.0.4 Source cves: unknown CVE Source advisory: MEND:WS-2018-0152...

Remote Code Execution (RCE)

funcster is vulnerable to remote code execution RCE attacks. The application uses the unsafe shell execution API commands, allowing a malicious user to inject and execute arbitrary code through the git checkout command...

Node.js third-party modules: Insecure implementation of deserialization in funcster

I would like to report code injection in serialization package funcster. It allows execute arbitrary code during deserialization of JSON. Module module name: funcster version: 0.0.3 npm page: https://www.npmjs.com/package/funcster Module Description This library contains utilities for serializing...