https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 07:16:23 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-42204 EUVD-2026-42204 https://cve.radiocsirt.org/vuln/euvd-2026-42204 https://cve.radiocsirt.org/vuln/fkie_cve-2020-14000 <p>MIT Lifelong Kindergarten Scratch scratch-vm before 0.2.0-prerelease.20200714185213 loads extension URLs from untrusted project.json files with certain _ characters, resulting in remote code execution because the URL&#39;s content is treated as a script and is executed as a worker. The responsible code is getExtensionIdForOpcode in serialization/sb3.js. The use of _ is incompatible with a protection mechanism in older versions, in which URLs were split and consequently deserialization attacks were prevented. NOTE: the scratch.mit.edu hosted service is not affected because of the lack of worker scripts.</p> <p>MIT Lifelong Kindergarten Scratch scratch-vm before 0.2.0-prerelease.20200714185213 loads extension URLs from untrusted project.json files with certain _ characters, resulting in remote code execution because the URL&#39;s content is treated as a script and is executed as a worker. The responsible code is getExtensionIdForOpcode in serialization/sb3.js. The use of _ is incompatible with a protection mechanism in older versions, in which URLs were split and consequently deserialization attacks were prevented. NOTE: the scratch.mit.edu hosted service is not affected because of the lack of worker scripts.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-14000 https://cve.radiocsirt.org/vuln/ghsa-vc9j-fhvv-8vrf <p><strong>Affected:</strong> npm: scratch-vm</p> <p>MIT Lifelong Kindergarten Scratch scratch-vm before `0.2.0-prerelease.20200714185213` loads extension URLs from untrusted project.json files with certain `_` characters, resulting in remote code execution because the URL&#39;s content is treated as a script and is executed as a worker. The responsible code is `getExtensionIdForOpcode` in serialization/sb3.js. The use of `_` is incompatible with a protection mechanism in older versions, in which URLs were split and consequently deserialization attacks were prevented.</p> <p>**NOTE**: the scratch.mit.edu hosted service is not affected because of the lack of worker scripts.</p> <p><strong>Affected:</strong> npm: scratch-vm</p> <p>MIT Lifelong Kindergarten Scratch scratch-vm before `0.2.0-prerelease.20200714185213` loads extension URLs from untrusted project.json files with certain `_` characters, resulting in remote code execution because the URL&#39;s content is treated as a script and is executed as a worker. The responsible code is `getExtensionIdForOpcode` in serialization/sb3.js. The use of `_` is incompatible with a protection mechanism in older versions, in which URLs were split and consequently deserialization attacks were prevented.</p> <p>**NOTE**: the scratch.mit.edu hosted service is not affected because of the lack of worker scripts.</p> https://cve.radiocsirt.org/vuln/ghsa-vc9j-fhvv-8vrf https://cve.radiocsirt.org/vuln/gsd-2020-14000 gsd-2020-14000 https://cve.radiocsirt.org/vuln/gsd-2020-14000