Snyk Security Database

eth-slint is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

ansible-core is an a radically simple IT automation system. It handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. Ansible makes complex changes like zero-downtime rolling updates with load balancers easy.

Affected versions of this package are vulnerable to Arbitrary Argument Injection via the collection install process when handling git sources without proper argument separation. An attacker can execute arbitrary commands by supplying a crafted git source URI containing malicious arguments. This is only exploitable if collections are installed from untrusted or non-HTTPS git sources.

com.alibaba:fastjson is a fast JSON parser/generator for Java.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the JSON parsing path in JSON.parse, JSON.parseObject(String), and JSON.parseObject(String, Class) when it runs inside a Spring Boot executable fat-jar. An attacker can execute code by supplying crafted JSON that reaches the vulnerable type-resolution logic, including nested payloads in Object or Map fields. The issue affects applications using the stock default configuration, and it can let a remote attacker run arbitrary code in the process that deserializes the JSON.

Notes

• The vulnerable path is verified only in Spring Boot executable fat-jar deployments started with java -jar; plain classpath launches and WAR-style deployments are outside the documented trigger condition.
• The issue is present under fastjson’s stock defaults with AutoType and SafeMode both off; enabling SafeMode blocks the vulnerable @type handling before this path is reached.

Workarounds

• Enable SafeMode by setting -Dfastjson.parser.safeMode=true, calling ParserConfig.getGlobalInstance().setSafeMode(true), or configuring it in fastjson.properties; this blocks @type-based payloads before they reach the vulnerable parsing path.
• Switch to a noneautotype build such as com.alibaba:fastjson:1.2.83_noneautotype; this removes the vulnerable code path from the deployed artifact.
• Migrate to fastjson2; this avoids the vulnerable fastjson 1.x parsing behavior in affected deployments.