CVE-2021-21414
High
Description
Prisma is an open source ORM for Node.js & TypeScript. As of today, we are not aware of any Prisma users or external consumers of the `@prisma/sdk` package who are affected by this security vulnerability. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. It only affects the `getPackedPackage` function and this function is not advertised and only used for tests & building our CLI, no malicious code was found after checking our codebase.
SeverityHigh
CVSS7.7
Exploit probability—
Product
Prisma
PublishedApr 29, 2021
First seenApr 29, 2021
Weakness typeCWE-78OS command injection
How to fix
Update
- prisma prisma2.20.0 or later
- @prisma/sdk2.20.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| prisma prisma | v < 2.20.0 | 2.20.0 |
| @prisma/sdknpm | v < 2.20.0 | 2.20.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.