Description
An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constructor() component.
Remediation
References
https://github.com/nacos-group/nacos-spring-project/issues/314
Related Vulnerabilities
CVE-2021-23363 Vulnerability in npm package kill-by-port
CVE-2017-16110 Vulnerability in npm package weather.swlyons
CVE-2018-3767 Vulnerability in npm package memjs
CVE-2020-1956 Vulnerability in maven package org.apache.kylin:kylin-core-common
CVE-2021-23341 Vulnerability in maven package org.webjars.npm:prismjs