Improper Input Validation Affecting scratch-vm package, versions >=0.1.0-prerelease.1524239808 <0.2.0-prerelease.20200714185213
Threat Intelligence
EPSS
3.19% (92nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-SCRATCHVM-584565
- published 15 Jul 2020
- disclosed 15 Jul 2020
- credit apple502j
Introduced: 15 Jul 2020
CVE-2020-14000 Open this link in a new tabHow to fix?
Upgrade scratch-vm to version 0.2.0-prerelease.20200714185213 or higher.
Overview
scratch-vm is a Virtual Machine for Scratch 3.0
Affected versions of this package are vulnerable to Improper Input Validation. When loading an SB3, it is determined whether a block is part of an extension by inspecting its "extended" opcode (for example, pen_clear requires the pen extension). The extension ID is not sanitised, and some characters may cause potential problems.
References
CVSS Scores
version 3.1