Executive brief
msgpack is a binary serialization library used to encode and decode data efficiently across applications and services. A deserialization vulnerability in the unpack function allows attackers to execute arbitrary code by sending specially crafted msgpack-formatted data, potentially compromising any system processing untrusted msgpack payloads.
Technical details
This vulnerability (CWE-502) is a classic unsafe deserialization flaw in the msgpack Node.js library's unpack function. The vulnerability affects all versions up to 1.0.3 and allows an attacker to execute arbitrary code by providing malicious serialized data without authentication or user interaction required. The attack is network-accessible (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) and results in complete compromise of confidentiality, integrity, and availability. Note: This advisory was withdrawn by Snyk on 2021-09-15, suggesting potential disagreement over the vulnerability assessment or impact classification.
Affected products
- msgpack msgpack up to 1.0.3
Timeline
- 2021-07-26: disclosed
- 2021-07-21: advisory: NVD published
- 2021-09-15: other: Advisory withdrawn by CNA (Snyk)