{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-06T00:47:45.172","vulnerabilities":[{"cve":{"id":"CVE-2021-21423","sourceIdentifier":"security-advisories@github.com","published":"2021-04-06T19:15:14.787","lastModified":"2024-11-21T05:48:19.907","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"`projen` is a project generation tool that synthesizes project configuration files such as `package.json`, `tsconfig.json`, `.gitignore`, GitHub Workflows, `eslint`, `jest`, and more, from a well-typed definition written in JavaScript. Users of projen's `NodeProject` project type (including any project type derived from it) include a `.github/workflows/rebuild-bot.yml` workflow that may allow any GitHub user to trigger execution of un-trusted code in the context of the \"main\" repository (as opposed to that of a fork). In some situations, such untrusted code may potentially be able to commit to the \"main\" repository. The rebuild-bot workflow is triggered by comments including `@projen rebuild` on pull-request to trigger a re-build of the projen project, and updating the pull request with the updated files. This workflow is triggered by an `issue_comment` event, and thus always executes with a `GITHUB_TOKEN` belonging to the repository into which the pull-request is made (this is in contrast with workflows triggered by `pull_request` events, which always execute with a `GITHUB_TOKEN` belonging to the repository from which the pull-request is made). Repositories that do not have branch protection configured on their default branch (typically `main` or `master`) could possibly allow an untrusted user to gain access to secrets configured on the repository (such as NPM tokens, etc). Branch protection prohibits this escalation, as the managed `GITHUB_TOKEN` would not be able to modify the contents of a protected branch and affected workflows must be defined on the default branch."},{"lang":"es","value":"“projen” es una herramienta de generación de proyectos que sintetiza archivos de configuración de proyectos como “package.json”, “tsconfig.json”, “.gitignore”, GitHub Workflows, “eslint”,” jest`, y más, desde una definición well-typed escrita en JavaScript. Los usuarios de tipo de proyecto “NodeProject” de projen (incluido cualquier tipo de proyecto derivado de él) incluyen un flujo de trabajo “.github/workflows /rebuild-bot.yml” que puede permitir que cualquier usuario de GitHub active la ejecución de código no confiable en el contexto del repositorio \"main\" (en contraposición al de una bifurcación). En algunas situaciones, dicho código que no es de confianza puede potencialmente ser capaz de comprometerse con el repositorio \"main\". El flujo de trabajo rebuild-bot es activado con comentarios que incluyen  “@projen rebuild” en la petición de extracción para activar un re-build del proyecto projen y la actualización de la petición de extracción con los archivos actualizados. Este flujo de trabajo es desencadenado por un evento “issue_comment” y, por lo tanto, siempre se ejecuta con un “GITHUB_TOKEN” que pertenece al repositorio en el que la petición de extracción es realizada (esto contrasta con los flujos de trabajo desencadenados por eventos “pull_request”, que siempre se ejecutan con un “GITHUB_TOKEN” perteneciente al repositorio desde el que la pull-request es realizada). Los repositorios que no contienen la protección de rama configurada en su rama predeterminada (normalmente, \"main\" o \"master\") posiblemente podrían permitir a un usuario no confiable conseguir acceso a secretos configurados en el repositorio (como tokens NPM, etc.). La protección de rama prohíbe esta escalada, ya que el \"GITHUB_TOKEN\" administrado no podría ser capaz de modificar el contenido de una rama protegida y los flujos de trabajo afectados deben definirse en la rama predeterminada"}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:N","baseScore":5.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-527"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:projen_project:projen:*:*:*:*:*:node.js:*:*","versionStartIncluding":"0.6.0","versionEndExcluding":"0.16.41","matchCriteriaId":"A2E0EE70-F6DF-4821-ACC1-71E47B43303D"}]}]}],"references":[{"url":"https://github.com/projen/projen/commit/36030c6a4b1acd0054673322612e7c70e9446643","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/projen/projen/security/advisories/GHSA-gg2g-m5wc-vccq","source":"security-advisories@github.com","tags":["Mitigation","Third Party Advisory"]},{"url":"https://www.npmjs.com/package/projen","source":"security-advisories@github.com","tags":["Product","Third Party Advisory"]},{"url":"https://github.com/projen/projen/commit/36030c6a4b1acd0054673322612e7c70e9446643","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/projen/projen/security/advisories/GHSA-gg2g-m5wc-vccq","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Third Party Advisory"]},{"url":"https://www.npmjs.com/package/projen","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product","Third Party Advisory"]}]}}]}