NodeBB is Node.js based forum software. Starting in version 2.5.0 and prior to version 2.8.7, due to the use of the object destructuring assignment syntax in the user export code path, combined with a path traversal vulnerability, a specially crafted payload could invoke the user export logic to arbitrarily execute javascript files on the local disk. This issue is patched in version 2.8.7. As a workaround, site maintainers can cherry pick the fix into their codebase to patch the exploit.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HNodebb
APPNodebb2.5.0 – 2.8.7 (bez)
Related vulnerabilities
A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software pri...
NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in so...
NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It u...
Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerabilit...
Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the tok...