Executive brief
ScandiPWA magento-scripts is a Node.js utility for managing Magento development environments via Docker. After an internal refactor to support asynchronous operations, several critical CLI commands (start, stop, exec, logs) became non-functional due to missing error handlers, rendering the tool unable to execute its core functionality and preventing developers from managing their local development environments.
Technical details
The vulnerability is a missing error handler issue (CWE-431) in the @scandipwa/magento-scripts CLI tool. During a refactor to support asynchronous operations, promise handlers were not properly implemented for the start, stop, exec, and logs commands, causing them to fail silently or throw unhandled exceptions. No authentication or special access is required—any local user invoking these commands will encounter failures. The impact is a denial of service to the tool's core functionality, preventing developers from managing their Magento development environments. This is a local-only issue with attack vector being local user execution. The fix was released in version 1.5.3.
Affected products
- ScandiPWA @scandipwa/magento-scripts 1.5.1 to 1.5.2
Timeline
- 2021-06-14: disclosed: NVD published advisory
- 2021-06-16: disclosed: GitHub security advisory reviewed
- 2021-06-21: disclosed: Published on GitHub and OSV
- 2021-06-14: patched: Version 1.5.3 released with fix