CVSS 3.1
8.3 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:LCVE-2020-7738
High (8.3) in shiba project shiba. EPSS 1.6% chance of exploitation in the next 30 days.
All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load() of the package js-yaml instead of its secure replacement , safeLoad().
Severity
- EPSS
- 1.6% chance of exploitation in the next 30 days; higher than 75% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- shiba_project:shiba
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-jvf4-g24p-2qgw | npm | shiba | <=1.2.1 | no fix published |