GHSA-r83x-wj75-v89r

    Dashboard / Vulnerabilities / GHSA-r83x-wj75-v89r

    GHSA-r83x-wj75-v89r

    Published: 13 May 2022Last Modified: 8 Nov 2023
    Aliases:
    CVE-2018-6333

    Summary: Nuclide Improper Input Validation

    Details: The hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering. As a result, a malicious URL could be used to render HTML and other content inside of the editor's context, which could potentially be chained to lead to code execution. This issue affected Nuclide prior to v0.290.0.

    References: https://nvd.nist.gov/vuln/detail/CVE-2018-6333, https://github.com/facebook/nuclide/commit/65f6bbd683404be1bb569b8d1be84b5d4c74a324

    Affected packages

    Package

    Name: nuclide

    Purl: pkg:npm/nuclide

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -0.290.0

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-r83x-wj75-v89r | CVE-DB