-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in the executeJavaScriptCode function located in packages/components/src/utils.ts. The provided patch for commit 10aa58e53b5bb7ef322d9f95c1a8b8850817cc35 clearly shows the modification in this function. Before the patch, the function would concatenate availableDependencies (which includes Puppeteer and Playwright) with externalDeps without any restriction. This allowed an authenticated attacker to use these built-in modules to execute arbitrary commands, bypassing the sandbox. The fix introduces a check for the ALLOW_BUILTIN_DEP environment variable. If this variable is not explicitly set to true, the availableDependencies are not loaded, effectively preventing the vulnerability. Therefore, the executeJavaScriptCode function is the exact location of the vulnerability.
executeJavaScriptCodepackages/components/src/utils.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| flowise | npm | >= 3.0.1, < 3.0.8 | 3.0.8 |
JavaScriptJavaScriptOngoing coverage of React2Shell