Withdrawn: Octocat.js vulnerable to code injection
Date: 2022-11
Affected: npm/octocat.js
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2022-39390
CWE: CWE-74
CWE-94

## Withdrawn This advisory has been withdrawn because it is a test. ## Original Description ### Impact Users can include their own images for accessories via provided URLs. These URLs are not validated and can result in execution of injected code. ### Patches This vulnerability was fixed in version 1.2 of octocat.js ### Workarounds Directly exposing rendered images to a website can introduce the vulnerability to users. To avoid, writing an image to disk then using that image in an image element in HTML mitigates the risk. ### References To render the file correctly, see documentation at `readme.md` ### For more information If you have any questions or comments about this advisory: * Open an issue in [the octo.js repository](http://github.com/octocademy/octocat.js/issues)


Mitigations:

Architectural layers (MAESTRO):