@refinedev/inferencer through 7.0.0 Code Injection via API Field Names
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.7epss 0.5%
probabilidade de exploração
0.5%top 61% das CVEs
exploração observada
nãonenhuma fonte reporta
@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page renders.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
refinedev · @refinedev/inferencerReferências
https://github.com/refinedev/refinehttps://github.com/refinedev/refine/blob/main/packages/inferencer/src/create-inferencer/index.tsx#L117-L128https://github.com/refinedev/refine/blob/main/packages/inferencer/src/inferencers/antd/list.tsx#L140-L144https://github.com/refinedev/refine/issues/7556https://www.vulncheck.com/advisories/refinedev-inferencer-through-7.0.0-code-injection-via-api-field-names