medium5.6
CVE-2021-20066
Withdrawn Advisory: Insufficient Granularity of Access Control in JSDom
Impact
# Withdrawn Advisory This advisory has been withdrawn because the user must configure jsdom to allow access to local files. # Original Description JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | jsdom | <= 16.4.0 | 16.5.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jsdom Project | Jsdom | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/jsdom/jsdom/issues/3124#issuecomment-783502951
- https://www.tenable.com/security/research/tra-2021-05
- https://github.com/advisories/GHSA-f4c9-cqv8-9v98
- https://nvd.nist.gov/vuln/detail/CVE-2021-20066
- https://github.com/jsdom/jsdom/issues/3124
- https://security.snyk.io/vuln/SNYK-JS-JSDOM-1075447