tsParticles stable publish workflow runs shell commands from release notes
Attacker commands can run secretly when maintainers publish.
Summary
The tsParticles stable publish workflow interprets generated release-note text as shell commands. When a maintainer starts a stable release with contributor-controlled text present, arbitrary commands can run; versions 4.0.0 up to but not including 4.3.2 are affected.
Affected when
- Contributor-written text included in generated release notes
- Maintainer starts a stable release through the publish workflow
What to do
Update to tsparticles 4.3.2 or newer.
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
Times
First published
First seen