GHSA-8j6j-4h2c-c65p: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability was identified in the require-node npm package (GHSA-8j6j-4h2c-c65p), discovered and published to the GitHub Advisory Database on September 3, 2020. The vulnerability affects versions prior to 1.3.4 for 1.x series and versions between 2.0.0 and 2.0.4 for 2.x series. This security issue was reviewed on August 31, 2020, and last updated on January 12, 2023 (GitHub Advisory).

The vulnerability is classified as an Arbitrary Code Execution flaw, categorized under CWE-78. The core issue stems from the package's failure to properly sanitize requests to the require-node endpoint, which creates a security gap that could be exploited. The severity of this vulnerability is rated as Critical, though no specific CVSS score was provided (GitHub Advisory).

The vulnerability allows attackers to execute arbitrary code on the server through the injection of OS commands in the request body. This presents a significant security risk as it could potentially give attackers complete control over the affected server (GitHub Advisory).

The vulnerability can be exploited by sending malicious requests to the require-node endpoint, taking advantage of the lack of proper request sanitization. No specific instances of exploitation in the wild have been reported (GitHub Advisory).

Users are strongly advised to upgrade their require-node package to patched versions. For those using the 1.x series, upgrading to version 1.3.4 or later is recommended. Users of the 2.x series should upgrade to version 2.0.4 or later (GitHub Advisory, NPM Advisory).