[GHSA-h738-vh6g-q8gh] OS command injection in the npm package loading component... - #8847
Conversation
| { | ||
| "type": "CVSS_V3", | ||
| "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" | ||
| }, |
There was a problem hiding this comment.
Two notes on the severity block in this PR, both caused by the advisory edit
form rather than intentional changes:
-
CVSS v4 vector normalization
The original v4 vector string could not be parsed by the edit form, which
blocked submission. It was normalized by removing the trailing "Not Defined"
(:X) threat, environmental, and supplemental placeholders. All eleven base
metrics are unchanged (AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
and the score remains 8.4 / High. -
Unintended removal of the CVSS v3.1 entry
The form only allows selecting a single CVSS version, so saving the v4 vector
dropped the existing CVSS_V3 entry:
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
This removal was not intended. Please let me know if you would like it
restored and I will push a commit adding it back, or feel free to restore it
during curation.
The substantive change in this PR is the missing npm ecosystem and package
mapping for jsii-diff, plus the source code location.
Updates
Comments
Adds the missing ecosystem and package mapping for this unreviewed advisory.
The advisory title already identifies the affected package as the npm package
jsii-diff, but no ecosystem or package name was assigned, so npm projects
depending on jsii-diff do not receive Dependabot alerts.
The AWS security bulletin and the linked jsii release (both already present in
this advisory's references) confirm the fix landed in v1.131.0. jsii-diff is
published on npm by AWS from the aws/jsii repository.
Sources:
No changes were made to the description, references, severity, CVSS, or CWE.