GHSA-wxf3-4fvj-vqqx: @saltcorn/cli Unsafe Plugins Can Be Installed Vulnerability
HIGHGHSA-wxf3-4fvj-vqqx is a HIGH (CVSS 8.7) unsafe plugins can be installed vulnerability (General Security Weakness) affecting @saltcorn/cli libraries in the npm ecosystem. The issue involves unsafe plugins can be installed via pack import by tenant admins. Remediation is available by upgrading affected packages to version 0.8.8-beta.2.
GHSA-wxf3-4fvj-vqqx at a Glance
Security Impact
CVSS: 8.7
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H).
How to Fix GHSA-wxf3-4fvj-vqqx
To remediate this vulnerability, upgrade all affected @saltcorn/cli dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @saltcorn/cli@0.8.8-beta.2Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @saltcorn/cliHow to Check if You Are Affected
To determine whether your Node.js application is affected by GHSA-wxf3-4fvj-vqqx, inspect your project dependencies using npm:
npm ls @saltcorn/cliAnalyze the terminal output to locate any version of @saltcorn/cli in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.8.8-beta.2), your application is affected.
Note: The npm ls @saltcorn/cli command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under General Security Weakness. In @saltcorn/cli, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-wxf3-4fvj-vqqx Affected @saltcorn/cli Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@saltcorn/cli
|
npm |
< 0.8.8-beta.2
|
0.8.8-beta.2
|
References
Frequently Asked Questions
What is GHSA-wxf3-4fvj-vqqx?
Which @saltcorn/cli versions are affected?
What version fixes GHSA-wxf3-4fvj-vqqx?
Is @saltcorn/cli affected?
What is the CVSS score of GHSA-wxf3-4fvj-vqqx?
What CWE is associated with GHSA-wxf3-4fvj-vqqx?
How can I check npm dependencies for GHSA-wxf3-4fvj-vqqx?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-wxf3-4fvj-vqqx",
"modified" : "2026-01-16T21:55:54Z",
"published" : "2023-07-27T19:28:02Z",
"aliases" : [ ],
"summary" : "Unsafe plugins can be installed via pack import by tenant admins",
"details" : "### Summary\nUnsafe plugins (for instance `sql-list`) can be installed in subdomain tenants via pack import even if unsafe plugin installation for tenants is disables\n\n### Details\nI have an example\nhttps://bot20230704.saltcorn.com/view/all_plugins\nIt's publicly accessible (but has not so secure values except list of tenants).\nBut using this mech one can read **any** data from other tenants.\n\n### Impact\nAll tenants of installation (i.e. `saltcorn.com`), can be compromised from tenant user has admin access. If an untrusted user has admin rights to a tenant instance, they will be able to install a plug-in that can access information from other tenants\n\n### Revived after 0.8.7\nAfter patch in 0.8.7 this is not fixed completely.\n\nHere are steps to reproduce:\n1. Publish to NPM plugin that was not approved by admin (in case of saltcorn.com) by @glutamate. I've just published this one: https://www.npmjs.com/package/saltcorn-qrcode\n2. Publish somewhere plugin store that includes plugin from previous step: https://gist.github.com/pyhedgehog/f1fd7cb13f4d0a7ccf6a965748d19bd2\n3. Add plugin store link to tenant store.\n4. Install plugin.\n5. Use it in tenant: https://bot20230704.saltcorn.com/view/testqr_show/1\n\nHere are logic:\nUnsafe plugins checked against this list:\nhttps://github.com/saltcorn/saltcorn/blob/99fe277e497fd193bb070acd8c663aa254a9907c/packages/server/load_plugins.js#L191\nBut it's under control of tenant admin, not server admin.\nProposed login:\n```javascript\nconst safes = getRootState().getConfig(\"available_plugins\",[]).filter(p=>!p.unsafe).map(p=>p.location);\n```",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@saltcorn/cli"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.8.8-beta.2"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/saltcorn/saltcorn/security/advisories/GHSA-wxf3-4fvj-vqqx"
}, {
"type" : "WEB",
"url" : "https://github.com/saltcorn/saltcorn/pull/1973"
}, {
"type" : "WEB",
"url" : "https://github.com/saltcorn/saltcorn/commit/0f32a51277a635c814a634bda9b6d358fb8c04ab"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/saltcorn/saltcorn"
}, {
"type" : "WEB",
"url" : "https://github.com/saltcorn/saltcorn/blob/99fe277e497fd193bb070acd8c663aa254a9907c/packages/server/load_plugins.js#L191"
} ],
"database_specific" : {
"cwe_ids" : [ ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2023-07-27T19:28:02Z",
"nvd_published_at" : null
}
}