[GHSA-h738-vh6g-q8gh] OS command injection in the npm package loading component... - #8847
Conversation
| { | ||
| "type": "CVSS_V3", | ||
| "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" | ||
| }, |
There was a problem hiding this comment.
Two notes on the severity block in this PR, both caused by the advisory edit
form rather than intentional changes:
-
CVSS v4 vector normalization
The original v4 vector string could not be parsed by the edit form, which
blocked submission. It was normalized by removing the trailing "Not Defined"
(:X) threat, environmental, and supplemental placeholders. All eleven base
metrics are unchanged (AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
and the score remains 8.4 / High. -
Unintended removal of the CVSS v3.1 entry
The form only allows selecting a single CVSS version, so saving the v4 vector
dropped the existing CVSS_V3 entry:
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
This removal was not intended. Please let me know if you would like it
restored and I will push a commit adding it back, or feel free to restore it
during curation.
The substantive change in this PR is the missing npm ecosystem and package
mapping for jsii-diff, plus the source code location.
|
Closed as a duplicate of #8836 |
Updates
Comments
Adds the missing ecosystem and package mapping for this unreviewed advisory.
The advisory title already identifies the affected package as the npm package
jsii-diff, but no ecosystem or package name was assigned, so npm projects
depending on jsii-diff do not receive Dependabot alerts.
The AWS security bulletin and the linked jsii release (both already present in
this advisory's references) confirm the fix landed in v1.131.0. jsii-diff is
published on npm by AWS from the aws/jsii repository.
Sources:
No changes were made to the description, references, severity, CVSS, or CWE.