npm Updates
2464Warning Date
Severity Level
Warning Number
Target Sector
11 October, 2020
● High
2020-1899
All
Description:
npm has released security updates to address multiple vulnerabilities in the following products:
- nats
- 2.0.0-201 2.0.0-202 2.0.0-204 2.0.0-205 2.0.0-206
- jison
- 0.1.20 0.1.21 0.1.24 0.1.25 0.1.26 0.1.27 0.2.0 0.2.1 0.2.2 0.2.4 0.2.5 0.2.6 0.2.7 0.2.8 0.2.9 0.2.10 0.2.11 0.2.12 0.2.13 0.2.14 0.3.0 0.3.1 0.3.2 0.3.3 0.3.4 0.3.5 0.3.6 0.3.7 0.3.8 0.3.9 0.3.10 0.3.11 0.3.12 0.4.0 0.4.1 0.4.2 0.4.3 0.4.4 0.4.5 0.4.6 0.4.7 0.4.8 0.4.9 0.4.10 0.4.11 0.4.13 0.4.14 0.4.15 0.4.16 0.4.17 0.4.18
- next
- 9.5.0 9.5.1 9.5.2 9.5.3
Threats:
- Command Injection
- Execute arbiraty code
- Information disclosure
Best practice and Recommendations:
The CERT team encourages users to review npm security advisory and apply the necessary update: