Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@thi.ng/egf

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.4npmAmendedPublished

    [thi.ng/egf] Potential arbitrary code execution of #gpg-tagged property values

    CVE-2021-21412 · GHSA-rj44-gpjc-29r7

    Affected
    • npm @thi.ng/egf < 0.4.0
    Fixed in
    0.4.0· Vendor fix available
    Issue
    Impact Potential for arbitrary code execution in #gpg-tagged property values (only if decrypt: true option is enabled) Patches A fix has already been released as v0.4.0 Workarounds By default, EGF parse functions do NOT attempt to decrypt values (since GPG is only available in non-browser env). However, if GPG encrypted values are used/required: 1. Perform a regex search for #gpg-tagged values in the EGF source file/string and check for backtick (\) chars in the encrypted value string 2. Replace/remove them or skip parsing if present... References https://github.com/thi-ng/umbrella/security/advisories/GHSA-rj44-gpjc-29r7#advisory-comment-65261 For more information If you have any questions or comments about this advisory, please open an issue in the thi.ng/umbrella repo, of which this package is part of.

    Recommended action: Upgrade to 0.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →