Arbitrary Code Injection Affecting @asyncapi/modelina package, versions >=0.8.0 <1.0.0
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-ASYNCAPIMODELINA-3250307
- published 27 Jan 2023
- disclosed 27 Jan 2023
- credit Jonas Lagoni
Introduced: 27 Jan 2023
CVE-2023-23619 Open this link in a new tabHow to fix?
Upgrade @asyncapi/modelina to version 1.0.0 or higher.
Overview
@asyncapi/modelina is a The Model SDK for generating data models
Affected versions of this package are vulnerable to Arbitrary Code Injection when using the default presets, via the constructor() in TypeScriptGenerator.
NOTE: The maintainers advise that "it is impossible to fully guard against this, because users have access to the original raw information. However, as of version 1, if you only access the constrained models, you will not encounter this issue. Further similar situations are NOT seen as a security issue, but intended behavior."