← All advisories

Critical severity9.8NVD Advisory· Published Aug 21, 2024· Updated Jun 17, 2026

CVE-2024-40453

CVE-2024-40453

Description

squirrellyjs squirrelly v9.0.0 and fixed in v.9.0.1 was discovered to contain a code injection vulnerability via the component options.varName.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
squirrellynpm	>= 9.0.0, < 9.1.0	9.1.0

Affected products

3

Squirrelly/Squirrelly
cpe:2.3:a:squirrelly:squirrelly:9.0.0:*:*:*:*:node.js:*:*
Squirrellyjs/Squirrellycpe-rescue
ghsa-coords
pkg:npm/squirrelly
Range: >= 9.0.0, < 9.1.0

Patches

Vulnerability mechanics

References

5

github.com/squirrellyjs/squirrelly/pull/262nvdPatchWEB
samuzora.com/posts/cve-2024-40453nvdExploitWEB
github.com/advisories/GHSA-w5pw-gmcw-rfc8ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-40453ghsaADVISORY
github.com/squirrellyjs/squirrelly/commit/426f930e5ca1501404cd887071e734ec5feb0bcfghsaWEB

News mentions

0

No linked articles in our index yet.