Valine code injection vulnerability

严重 9.6CVE-2022-38545 · GHSA-mcvg-g9wx-v5vx · Published 19/09/2022 · updated 17/06/2026

要点

CVE-2022-38545 是影响 valine (valine.js), valine 的严重 (CVSS 9.6)漏洞。
未来 30 天内被利用的概率（EPSS）：34.1%，高于 98.4% 的漏洞。
修复：升级到 1.5.0 或更高版本。

Package	Affected versions	Patched versions
valine valine.js	`= 1.4.18`	No fix yet
valine npm	`< 1.5.0`	`1.5.0`

Description

Valine was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST request.

NVD description

Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST request.

References

nvd.nist.gov/vuln/detail/CVE-2022-38545 · ADVISORY
xCss/Valine · WEB
xCss/Valine commit c40826c · WEB
xCss/Valine · PACKAGE
xCss/Valine release v1.5.0 · WEB

valine 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

valine

valine.js

= 1.4.18

No fix yet

valine

npm

< 1.5.0

1.5.0

Description

Valine was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST request.

NVD description

Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST request.

valine 的其他漏洞

查看全部 →