cve.bz

CVE-2024-33434

9.8 criticalEPSS 1.4%

Critical (9.8). EPSS 1.4% chance of exploitation in the next 30 days. Fixed in github.com/tiagorlampert/CHAOS 0.0.0-20220716132853-b47438d36e3a.

An issue in tiagorlampert CHAOS v5.0.1 before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e allows a remote attacker to execute arbitrary code via the unsafe concatenation of the `filename` argument into the `buildStr` string without any sanitization or filtering.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
1.4% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
CWE
CWE-78
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-p3j6-f45h-hw5fGogithub.com/tiagorlampert/CHAOS<0.0.0-20220716132853-b47438d36e3a0.0.0-20220716132853-b47438d36e3a
GHSA-xfjj-f699-rc79Gogithub.com/tiagorlampert/CHAOS<0.0.0-20220716132853-b47438d36e3a0.0.0-20220716132853-b47438d36e3a
GO-2024-2822Gogithub.com/tiagorlampert/CHAOS<0.0.0-20220716132853-b47438d36e3a0.0.0-20220716132853-b47438d36e3a

References

Check your stackJSON