CVE-2022-0748 CRITICAL

CVE-2022-0748: Arbitrary Code Execution

Vendor N/A
Product post-loader
Published March 17, 2022
Last update September 17, 2024

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The package post-loader from 0.0.0 are vulnerable to Arbitrary Code Execution which uses a markdown parser in an unsafe way so that any javascript code inside the markdown input files gets evaluated and executed.

Key dates

02Disclosure timeline

March 17, 2022 CVE published
September 17, 2024 Record updated