CVE-2023-23619

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-23619", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-01-16T17:07:46.243Z", "datePublished": "2023-01-26T10:42:51.404Z", "dateUpdated": "2025-03-10T21:19:14.012Z"}, "containers": {"cna": {"title": "Improper Control of Generation of Code ('Code Injection') in @asyncapi/modelina", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/asyncapi/modelina/security/advisories/GHSA-4jg2-84c2-pj95", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/asyncapi/modelina/security/advisories/GHSA-4jg2-84c2-pj95"}], "affected": [{"vendor": "asyncapi", "product": "modelina", "versions": [{"version": "< 1.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-01-26T10:42:51.404Z"}, "descriptions": [{"lang": "en", "value": "Modelina is a library for generating data models based on inputs such as AsyncAPI, OpenAPI, or JSON Schema documents. Versions prior to 1.0.0 are vulnerable to Code injection. This issue affects anyone who is using the default presets and/or does not handle the functionality themself. This issue has been partially mitigated in version 1.0.0, with the maintainer's GitHub Security Advisory (GHSA) noting \"It is impossible to fully guard against this, because users have access to the original raw information. However, as of version 1, if you only access the constrained models, you will not encounter this issue. Further similar situations are NOT seen as a security issue, but intended behavior.\" The suggested workaround from the maintainers is \"Fully custom presets that change the entire rendering process which can then escape the user input.\""}], "source": {"advisory": "GHSA-4jg2-84c2-pj95", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:35:33.603Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/asyncapi/modelina/security/advisories/GHSA-4jg2-84c2-pj95", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/asyncapi/modelina/security/advisories/GHSA-4jg2-84c2-pj95"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-10T21:01:00.504071Z", "id": "CVE-2023-23619", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-10T21:19:14.012Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/asyncapi/modelina/security/advisories/GHSA-4jg2-84c2-pj95", "name": "https://github.com/asyncapi/modelina/security/advisories/GHSA-4jg2-84c2-pj95", "tags": ["x_refsource_CONFIRM", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:35:33.603Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-23619", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-03-10T21:01:00.504071Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-10T21:01:02.276Z"}}], "cna": {"title": "Improper Control of Generation of Code ('Code Injection') in @asyncapi/modelina", "source": {"advisory": "GHSA-4jg2-84c2-pj95", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "asyncapi", "product": "modelina", "versions": [{"status": "affected", "version": "< 1.0.0"}]}], "references": [{"url": "https://github.com/asyncapi/modelina/security/advisories/GHSA-4jg2-84c2-pj95", "name": "https://github.com/asyncapi/modelina/security/advisories/GHSA-4jg2-84c2-pj95", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Modelina is a library for generating data models based on inputs such as AsyncAPI, OpenAPI, or JSON Schema documents. Versions prior to 1.0.0 are vulnerable to Code injection. This issue affects anyone who is using the default presets and/or does not handle the functionality themself. This issue has been partially mitigated in version 1.0.0, with the maintainer's GitHub Security Advisory (GHSA) noting \"It is impossible to fully guard against this, because users have access to the original raw information. However, as of version 1, if you only access the constrained models, you will not encounter this issue. Further similar situations are NOT seen as a security issue, but intended behavior.\" The suggested workaround from the maintainers is \"Fully custom presets that change the entire rendering process which can then escape the user input.\""}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-01-26T10:42:51.404Z"}}}, "cveMetadata": {"cveId": "CVE-2023-23619", "state": "PUBLISHED", "dateUpdated": "2025-03-10T21:19:14.012Z", "dateReserved": "2023-01-16T17:07:46.243Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-01-26T10:42:51.404Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "modelina", "vendor": "asyncapi", "versions": [{"status": "affected", "version": "< 1.0.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:lfprojects:modelina:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "0A2550E7-A8E5-4013-ADA2-0903399206DD", "versionEndExcluding": "1.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Modelina is a library for generating data models based on inputs such as AsyncAPI, OpenAPI, or JSON Schema documents. Versions prior to 1.0.0 are vulnerable to Code injection. This issue affects anyone who is using the default presets and/or does not handle the functionality themself. This issue has been partially mitigated in version 1.0.0, with the maintainer's GitHub Security Advisory (GHSA) noting \"It is impossible to fully guard against this, because users have access to the original raw information. However, as of version 1, if you only access the constrained models, you will not encounter this issue. Further similar situations are NOT seen as a security issue, but intended behavior.\" The suggested workaround from the maintainers is \"Fully custom presets that change the entire rendering process which can then escape the user input.\""}, {"lang": "es", "value": "Modelina es una librer\u00eda para generar modelos de datos basados en entradas como documentos AsyncAPI, OpenAPI o JSON Schema. Las versiones anteriores a la 1.0.0 son vulnerables a la inyecci\u00f3n de c\u00f3digo. Este problema afecta a cualquiera que utilice los ajustes preestablecidos predeterminados y/o no maneje la funcionalidad por s\u00ed mismo. Este problema se ha mitigado parcialmente en la versi\u00f3n 1.0.0, y el GitHub Security Advisory (GHSA) del fabricante se\u00f1ala: \"Es imposible protegerse completamente contra esto, porque los usuarios tienen acceso a la informaci\u00f3n sin procesar original. Sin embargo, a partir de la versi\u00f3n 1, si solo accede a los modelos restringidos, no encontrar\u00e1 este problema. Otras situaciones similares NO se consideran un problema de seguridad, sino un comportamiento previsto\". La soluci\u00f3n sugerida por los fabricantees es \"Preajustes totalmente personalizados que cambian todo el proceso de renderizado y luego pueden escapar de la entrada del usuario\"."}], "id": "CVE-2023-23619", "lastModified": "2026-06-17T05:37:35.933", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-23619", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-03-10T21:01:00.504071Z", "version": "2.0.3"}}]}, "published": "2023-01-26T21:18:15.217", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/asyncapi/modelina/security/advisories/GHSA-4jg2-84c2-pj95"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/asyncapi/modelina/security/advisories/GHSA-4jg2-84c2-pj95"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}