High · published August 30, 2020
This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.
| Product | Versions | Fixed in |
|---|---|---|
| joyent/json | < 10.0.0 | 10.0.0 |
| oracle/commerce_guided_search | all versions | — |
| oracle/financial_services_crime_and_compliance_management_studio | all versions | — |
| oracle/financial_services_crime_and_compliance_management_studio | all versions | — |
| oracle/financial_services_regulatory_reporting_with_agilereporter | all versions | — |
| oracle/timesten_in-memory_database | < 21.1.1.1.0 | 21.1.1.1.0 |