Description
An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constructor() component.
Remediation
References
https://github.com/nacos-group/nacos-spring-project/issues/314
Related Vulnerabilities
CVE-2018-20677 Vulnerability in maven package org.webjars.npm:bootstrap
CVE-2015-1835 Vulnerability in npm package cordova-android
CVE-2021-23426 Vulnerability in npm package proto
CVE-2023-40809 Vulnerability in maven package org.opencrx:opencrx-core-models
CVE-2018-1999020 Vulnerability in maven package org.onosproject:onos-core-common