CVE-2021-33420

A deserialization issue discovered in inikulin replicator before 1.0.4 allows remote attackers to run arbitrary code via the fromSerializable function in TypedArray object.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
CISA-ADPADP
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 63%
VendorProductVersion
replicator_projectreplicator
𝑥
< 1.0.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://advisory.checkmarx.net/advisory/CX-2021-4787
https://github.com/inikulin/replicator/commit/2c626242fb4a118855262c64b5731b2ce98e521b
https://github.com/inikulin/replicator/issues/16
https://github.com/inikulin/replicator/pull/17
https://advisory.checkmarx.net/advisory/CX-2021-4787
https://github.com/inikulin/replicator/commit/2c626242fb4a118855262c64b5731b2ce98e521b
https://github.com/inikulin/replicator/issues/16
https://github.com/inikulin/replicator/pull/17