@rioclaid/cdk-constructs (>=0.7.10, <=0.7.30), @taimos/projen (>=0.0.1, <=0.0.35) +2 more potentially affected by CVE-2021-21423 via projen (>=0.6.22, <=0.15.18)

projen NPM version =0.6.22, =0.7.10, =0.0.1, =0.0.4, =0.0.2, =0.0.35 Source cves: CVE-2021-21423 Source advisory: OSV:GHSA-GG2G-M5WC-VCCQ...

Rebuild-bot workflow may allow unauthorised repository modifications

Impact projen is a project generation tool that synthesizes project configuration files such as package.json, tsconfig.json, .gitignore, GitHub Workflows, eslint, jest, and more, from a well-typed definition written in JavaScript. Users of projen's NodeProject project type including any project...

CVE-2021-21423

projen is a project generation tool that synthesizes project configuration files such as package.json, tsconfig.json, .gitignore, GitHub Workflows, eslint, jest, and more, from a well-typed definition written in JavaScript. Users of projen's NodeProject project type including any project type...

CVE-2021-21423 Exposure of Version-Control Repository to an Unauthorized Control Sphere in projen

projen is a project generation tool that synthesizes project configuration files such as package.json, tsconfig.json, .gitignore, GitHub Workflows, eslint, jest, and more, from a well-typed definition written in JavaScript. Users of projen's NodeProject project type including any project type...

CVE-2021-21423

CVE-2021-21423 concerns the projen build tool. The issue centers on the rebuild-bot GitHub workflow (triggered by issue_comment with @projen rebuild) which runs with the repository’s GITHUB_TOKEN and could allow untrusted code to affect the main branch, potentially exposing secrets or altering co...

PT-2021-14496

Name of the Vulnerable Software and Affected Versions projen versions prior to 0.16.41 projen versions prior to 0.17.0 Description The projen tool synthesizes project configuration files from a well-typed definition written in JavaScript. Users of projen's NodeProject project type include a...

CVE-2021-21423: Exposure of Version-Control Repository to an Unauthorized Control Sphere

projen is a project generation tool that synthesizes project configuration files such as package.json, tsconfig.json, .gitignore, GitHub Workflows, eslint, jest, and more, from a well-typed definition written in JavaScript. Users of projen's NodeProject project type including any project type...

Github projen 安全漏洞

Github projen is a Github open source application. It synthesizes project configuration files. A security vulnerability exists in projen that allows any GitHub user to trigger the execution of untrusted code in the context of the "main" repository...