jsreport vulnerable to code injection

2023-05-0818:30:17

Google

osv.dev

jsreport

security vulnerability

code injection

cve-2023-29017

vm2

package.json

jsreport-core

attacker

authority

playground server

malicious webpage

html file

software

0.014 Low

EPSS

Percentile

86.4%

JSON

jsreport prior to 3.11.3 had a version of vm2 vulnerable to CVE-2023-29017 hard coded in the package.json of the jsreport-core component. An attacker can use this vulnerability to obtain the authority of the jsreport playground server, or construct a malicious webpage/html file and send it to the user to attack the installed jsreport client.