CVE-2018-6333

https://notcve.org/view.php?id=CVE-2018-6333

The hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering. As a result, a malicious URL could be used to render HTML and other content inside of the editor's context, which could potentially be chained to lead to code execution. This issue affected Nuclide prior to v0.290.0. El gestor hhvm-attach deep link en Nuclide no sanea debidamente el parámetro hostname proporcionado durante la renderización. En consecuencia, una URL maliciosa podría utilizarse para renderizar HTML y otro tipo de contenido dentro del contexto del editor, lo cual podría ser encadenado para provocar la ejecución de código. • https://github.com/ossf-cve-benchmark/CVE-2018-6333 https://github.com/facebook/nuclide/commit/65f6bbd683404be1bb569b8d1be84b5d4c74a324 • CWE-20: Improper Input Validation CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •