{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-01T19:18:05.911","vulnerabilities":[{"cve":{"id":"CVE-2021-21412","sourceIdentifier":"security-advisories@github.com","published":"2021-03-30T18:15:15.840","lastModified":"2024-11-21T05:48:18.517","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Potential for arbitrary code execution in npm package @thi.ng/egf `#gpg`-tagged property values (only if `decrypt: true` option is enabled). PR with patch has been submitted and will has been released as of v0.4.0 By default the EGF parse functions do NOT attempt to decrypt values (since GPG only available in non-browser env). However, if GPG encrypted values are used/required: 1. Perform a regex search for `#gpg`-tagged values in the EGF source file/string and check for backtick (\\`) chars in the encrypted value string 2. Replace/remove them or skip parsing if present."},{"lang":"es","value":"Un potencial para una ejecución de código arbitraria en los valores de propiedad `#gpg`-tagged de @thi.ng/egf del paquete npm (solo si la opción `decrypt: true` está habilitada). Se ha enviado el PR con parche y se lanzará a partir de la versión v0.4.0 Por defecto, las funciones de análisis de EGF NO intentan descifrar valores (ya que GPG solo está disponible en entornos que no son del navegador). Sin embargo, si los valores cifrados GPG son usados o requeridos: 1. Realice una búsqueda de expresiones regulares para los valores `#gpg`-tagged en el archivo o cadena de origen EGF y compruebe los caracteres de comillas invertidas (\\`) en la cadena de valores cifrados 2. Reemplace u omita el análisis sintáctico si está presente."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:\\@thi.ng\\/egf_project:\\@thi.ng\\/egf:*:*:*:*:*:node.js:*:*","versionEndExcluding":"0.4.0","matchCriteriaId":"1E041F81-B590-4D49-8173-368C0F6AA0BF"}]}]}],"references":[{"url":"https://github.com/thi-ng/umbrella/blob/develop/packages/egf/CHANGELOG.md#040-2021-03-27","source":"security-advisories@github.com","tags":["Release Notes","Third Party Advisory"]},{"url":"https://github.com/thi-ng/umbrella/commit/88f61656e5f5cfba960013b8133186389efaf243","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/thi-ng/umbrella/security/advisories/GHSA-rj44-gpjc-29r7","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://www.npmjs.com/package/%40thi.ng/egf","source":"security-advisories@github.com"},{"url":"https://github.com/thi-ng/umbrella/blob/develop/packages/egf/CHANGELOG.md#040-2021-03-27","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Third Party Advisory"]},{"url":"https://github.com/thi-ng/umbrella/commit/88f61656e5f5cfba960013b8133186389efaf243","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/thi-ng/umbrella/security/advisories/GHSA-rj44-gpjc-29r7","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://www.npmjs.com/package/%40thi.ng/egf","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}]}