dherault / dherault/serverless-offline

Need a patch for the execa vulnerability

Open
#1,671 0 comments 2 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
5.3k
Forks
811
Avg merge
2d 4h
Merged PRs (30d)
3

Description

# Uncontrolled Search Path Element in execa

### Description

Attackers could trick execa into executing arbitrary binaries. This behaviour is caused by the setting `preferLocal=true` which makes execa search for locally installed binaries and executes them. This vulnerability is usually only exploitable when using execa on a client-side LOCAL application.

* **Severity:**

Critical
* **Project:** *********************************************
* **Tool:** Dependency Scanning
* **Scanner:** Gemnasium

### Location

* **File: *************************************/package-lock.json)

### Links

* https://github.com/sindresorhus/execa/releases/tag/v2.0.0

### Identifiers

* [Gemnasium-05cfa2e8-2d0c-42c1-8894-638e2f12ff3d](https://gitlab.com/gitlab-org/security-products/gemnasium-db/-/blob/master/npm/execa/GMS-2020-2.yml)

### Solution

Upgrade to version 2.0.0 or above.

### Evidence

**Vulnerable Package**

execa:0.7.0Uncontrolled Search Path Element in execa
Description Attackers could trick execa into executing arbitrary binaries. This behaviour is caused by the setting preferLocal=true which makes execa search for locally installed binaries and executes them. This vulnerability is usually only exploitable when using execa on a client-side LOCAL application. Severity:
Critical
Project: ************************************************* ) Tool: Dependency Scanning Scanner: Gemnasium Location File: *********************************************/package-lock.json) Links
https://github.com/sindresorhus/execa/releases/tag/v2.0.0
Identifiers
Gemnasium-05cfa2e8-2d0c-42c1-8894-638e2f12ff3d

Solution Upgrade to version 2.0.0 or above.


Evidence
Vulnerable Package execa:0.7.0

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.