This repository has been archived by the owner on Sep 1, 2023. It is now read-only.
Bundled alchemist-server is vulnerable to remote code execution #85
Labels
Comments
slashmili
added a commit
that referenced
this issue
Feb 23, 2017
Disable EVAL command as it is open to remote code execution vulnerability #85
|
@ivan thanks for reporting it. I removed EVAL command from this repo since we don't use it directly here! |
|
I think this should be reopened because "anyone" can still execute code on the machines of alchemist.vim users. |
|
Fixed in 2.8.0. Please update your plugin |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
alchemist.vim includes an alchemist-server vulnerable to unauthenticated remote code execution (see tonini/alchemist-server#14). It's unfixed as of now, but I'm opening this tracking issue as a (hopefully useful) reminder to update alchemist-server once that bug is fixed.
The text was updated successfully, but these errors were encountered: