CVE-2016-10546

Vulnerability

An arbitrary code injection vulnerability exists in PouchDB versions prior to 6.0.5 [1][2]. The flaw resides in the map/reduce functions used in temporary views and design documents. The code execution engine for this branch is not properly sandboxed, allowing untrusted JavaScript input to execute arbitrary code [1].

Exploitation

An attacker must have the ability to create or modify design documents in a PouchDB instance, typically requiring authenticated access to the database or the ability to trigger temporary views. By injecting malicious JavaScript into the map or reduce function strings, the attacker can bypass intended sandboxing and execute arbitrary code in the context of the database process [1][2].

Impact

Successful exploitation allows the attacker to run arbitrary JavaScript as well as system commands, leading to full compromise of the confidentiality, integrity, and availability of the application and potentially the underlying server [1][2].

Mitigation

Update PouchDB to version 6.0.5 or later, where the code execution engine is properly sandboxed to prevent arbitrary code injection [2]. No known workarounds exist for earlier versions.