CVE-2020-8128

CRITICAL

jsreport < 2.5.0 - Server-Side Request Forgery and Arbitrary Code Execution

Title source: llm

Description

An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code.

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://hackerone.com/reports/660565

Scores

CVSS v3 9.8

EPSS 0.0263

EPSS Percentile 83.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-829 CWE-918

Status published

Products (2)

jsreport/jsreport < 2.5.0

npm/jsreport 0 - 2.6.0npm

Published Feb 14, 2020

Tracked Since Feb 18, 2026