CVE-2020-14000
npm/scratch-vm
Deserialization of Untrusted Data
MIT Lifelong Kindergarten Scratch scratch-vm loads extension URLs from untrusted project.json
files with certain _
characters, resulting in remote code execution because the URL content is treated as a script and is executed as a worker. The responsible code is getExtensionIdForOpcode
in serialization/sb3.js
. The use of _
is incompatible with a protection mechanism in older versions, in which URLs were split and consequently deserialization attacks were prevented.
All versions before 0.2.0-prerelease.20200714185213
Unfortunately, there is no solution available yet.
2020-07-28
source |