Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

projen

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.6npmAmendedPublished

    Rebuild-bot workflow may allow unauthorised repository modifications

    CVE-2021-21423 · GHSA-gg2g-m5wc-vccq

    Affected
    • npm projen >= 0.6.0, < 0.16.41
    Fixed in
    0.16.41· Vendor fix available
    Issue
    Impact projen is a project generation tool that synthesizes project configuration files such as package.json, tsconfig.json, .gitignore, GitHub Workflows, eslint, jest, and more, from a well-typed definition written in JavaScript. Users of projen's NodeProject project type (including any project type derived from it) include a .github/workflows/rebuild-bot.yml workflow that may allow any GitHub user to trigger execution of un-trusted code in the context of the "main" repository (as opposed to that of a fork). In some situations, such untrusted code may potentially be able to commit to the "main" repository. The rebuild-bot workflow is triggered by comments including @projen rebuild on pull-request to trigger a re-build of the projen project, and updating the pull request with the updated files. This workflow is triggered by an issuecomment event, and thus always executes with a GITHUBTOKEN belonging to the repository into which the pull-request is made (this is in contrast with…

    Recommended action: Upgrade to 0.16.41 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →