Remote Code Execution Affecting xterm package, versions >=3.8.0 <3.8.1 >=3.9.0 <3.9.2 >=3.10.0 <3.10.1
Threat Intelligence
EPSS
2.71% (91st
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-XTERM-73496
- published 10 Jan 2019
- disclosed 9 Jan 2019
- credit Felix Wilhelm
How to fix?
Upgrade xterm to version 3.8.1, 3.9.2, 3.10.1 or higher.
Overview
xterm is a front-end component written in TypeScript that lets applications bring fully-featured terminals to their users in the browser. It's used by popular projects such as VS Code, Hyper and Theia.
Affected versions of this package are vulnerable to Remote Code Execution due to mishandling of the component special characters.
References
CVSS Scores
version 3.1