Lucene search
Veracode Vulnerability DatabaseVERACODE:25972HistoryJul 28, 2020 - 5:29 a.m.
Remote Code Execution (RCE)
2020-07-2805:29:53
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
9
remote code execution
serialization
scratch-vm
vulnerability
extension url
attacker
worker
EPSS
0.043
Percentile
92.4%
scratch-vm is vulnerable to remote code execution(RCE). It does not escape extension URL values in the function getExtensionIdForOpcode in serialization/sb3.js, allowing an attacker to inject _ characters and execute it as a worker.
Related
nodejs
nodejs
Remote Code Execution
2020-07-27 19:59:21
nvd
nvd
CVE-2020-14000
2020-07-16 15:15:27
cvelist
cvelist
CVE-2020-14000
2020-07-16 14:41:40
osv
osv
Remote Code Execution in scratch-vm
2020-07-27 19:55:52
githubexploit
githubexploit
Exploit for Deserialization of Untrusted Data in Mit Scratch-Vm
2020-12-01 09:45:48
cve
cve
CVE-2020-14000
2020-07-16 15:15:27
github
github
Remote Code Execution in scratch-vm
2020-07-27 19:55:52
prion
prion
Deserialization of untrusted data
2020-07-16 15:15:00