Skip to content

Arbitrary Code Injection in pouchdb

Critical severity GitHub Reviewed Published Jul 26, 2018 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

npm pouchdb (npm)

Affected versions

< 6.0.5

Patched versions

6.0.5

Description

Affected versions of pouchdb do not properly sandbox the code execution engine which executes the map/reduce functions for temporary views and design documents. Under certain circumstances, an attacker could uses this to run arbitrary code on the server.

Recommendation

Update to version 6.0.5 or later.

References

Published to the GitHub Advisory Database Jul 26, 2018
Reviewed Jun 16, 2020
Last updated Jan 9, 2023

Severity

Critical

EPSS score

0.224%
(61st percentile)

Weaknesses

CVE ID

CVE-2016-10546

GHSA ID

GHSA-cgqv-x5cx-xvqh

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.