Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE-2022-21211 - Unhandled crash in npm posix #66

Open
tucks opened this issue Jul 17, 2022 · 1 comment
Open

CVE-2022-21211 - Unhandled crash in npm posix #66

tucks opened this issue Jul 17, 2022 · 1 comment

Comments

@tucks
Copy link

tucks commented Jul 17, 2022

This affects all versions of package posix. When invoking the toString method, it will fallback to 0x0 value, as the value of toString is not invokable (not a function), and then it will crash with type-check.

GHSA-27mx-gchc-6xjp

@williamstein
Copy link

For what it is worth, I happened to create another node.js package (inspired by this one) that doesn't have this vulnerability:

https://www.npmjs.com/package/posix-node

I'm not claiming it doesn't have any other vulnerabilities or possibly even worse ones -- the very nature of this posix module is that it involves some dangerous functionality nodejs doesn't expose.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants