CVE-2024-34347 json
@hoppscotch/cli affected by Sandbox Escape in @hoppscotch/js-sandbox leads to RCE
published 2024-04-22 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-1283 , GHSA-qmmm-73r2-f8xr
- cvss
- 8.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 49%
- public exploits
- 0
- none known
Summary
@hoppscotch/cli is a CLI to run Hoppscotch Test Scripts in CI environments. Prior to 0.8.0, the @hoppscotch/js-sandbox package provides a Javascript sandbox that uses the Node.js vm module. However, the vm module is not safe for sandboxing untrusted Javascript code. This is because code inside the vm context can break out if it can get a hold of any reference to an object created outside of the vm. In the case of @hoppscotch/js-sandbox, multiple references to external objects are passed into the vm context to allow pre-request scripts interactions with environment variables and more. But this also allows the pre-request script to escape the sandbox. This vulnerability is fixed in 0.8.0.
Patch / fix
- npm @hoppscotch/cli 0.8.0
- hoppscotch hoppscotch 0.8.0
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.62% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 8.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @hoppscotch/cli | >=0.5.0, <0.8.0 |
0.8.0 |
Affected products
- hoppscotch hoppscotch
Classification
- Weakness
-
- CWE-77 Improper Neutralization of Special Elements used in a Command
References
-
github.com
/hoppscotch/hoppscotch/commit/22c6eabd133195d22874250a5ae40cb26b851b01
web
-
github.com
/hoppscotch/hoppscotch/security/advisories/GHSA-qmmm-73r2-f8xr
web
-
sonarsource.com
/blog/scripting-outside-the-box-api-client-security-risks-part-2
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-34347
advisory
-
github.com
/hoppscotch/hoppscotch
package
Sources
- CVE List CVE-2024-34347
- GitHub Advisory GHSA-qmmm-73r2-f8xr
- NVD CVE-2024-34347
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.