| शीर्षक | RubyLouvre avalon 0.9.9 - 2.2.10 Code Injection / Prototype Pollution |
|---|
| विवरण | Avalon MVVM framework stores template filters in a plain object (avalon.filters = {}) and accesses them via bracket notation without hasOwnProperty protection. Attackers can access Object.prototype properties through filter names like __proto__ or constructor. Combined with the template parser's use of new Function() for expression compilation, this enables Remote Code Execution when an attacker controls template content. Project is unmaintained since 2019 but still widely used in legacy systems. |
|---|
| स्रोत | ⚠️ https://github.com/OriginSecurityX/avalon-filter-rce |
|---|
| उपयोगकर्ता | Frederick (UID 98351) |
|---|
| सबमिशन | 18/05/2026 12:00 PM (5 महीनों पहले) |
|---|
| संयम | 14/06/2026 02:27 PM (27 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 370851 [RubyLouvre avalon तक 2.2.10 Template Filter src/filters/index.js] |
|---|
| अंक | 20 |
|---|