@Thi.Ng/Egf
Approved changes feed: RSS · Atom
cpe:2.3:a:\@thi.ng\/egf_project:\@thi.ng\/egf:*:*:*:*:*:node.js:*:*
part: a version: * update: *
| Vendor | @Thi.Ng/Egf Project (c5624ddc-9486-5f12-8a6b-c00eabb910b4) |
|---|---|
| Product | @Thi.Ng/Egf (6ea9e462-f739-5c47-8a0e-4fcad489f6f8) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | node.js |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-21412 |
vulnerable | 2026-06-08 05:29:11.977178 |
[thi.ng/egf] Potential arbitrary code execution of `#gpg`-tagged property values
MEDIUM (6.4)
Potential for arbitrary code execution in npm package @thi.ng/egf `#gpg`-tagged property values (only if `decrypt: true` option is enabled). PR with patch has been submitted and will has been released as of v0.4.0 By default the EGF parse functions do NOT attempt to decrypt values (since GPG only available in non-browser env). However, if GPG encrypted values are used/required: 1. Perform a regex search for `#gpg`-tagged values in the EGF source file/string and check for backtick (\`) chars in the encrypted value string 2. Replace/remove them or skip parsing if present.
Published: 2021-03-30T17:40:15.000Z
Updated: 2024-08-03T18:09:16.142Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.