Improper Input Validation Affecting scratch-vm package, versions >=0.1.0-prerelease.1524239808 <0.2.0-prerelease.20200714185213



    Attack Complexity High

    Threat Intelligence

    EPSS 3.19% (92nd percentile)
Expand this section
9.8 critical

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-SCRATCHVM-584565
  • published 15 Jul 2020
  • disclosed 15 Jul 2020
  • credit apple502j

How to fix?

Upgrade scratch-vm to version 0.2.0-prerelease.20200714185213 or higher.


scratch-vm is a Virtual Machine for Scratch 3.0

Affected versions of this package are vulnerable to Improper Input Validation. When loading an SB3, it is determined whether a block is part of an extension by inspecting its "extended" opcode (for example, pen_clear requires the pen extension). The extension ID is not sanitised, and some characters may cause potential problems.