3 ms·
Here's a patch diff: https://github.com/vercel/next.js/compare/v15.0.4...v15.0.5 https://github.com/vercel/next.js/compare/v15.0.4...v15.0.5 It looks like the
by bri3d 11mo ago
Here's a patch diff:
https://github.com/vercel/next.js/compare/v15.0.4...v15.0.5 https://github.com/vercel/next.js/compare/v15.0.4...v15.0.5
It looks like the fix is checking hasOwnProperty, so it's almost certainly an issue with prototype chain pollution.
- cyberax 11mo agoI think this is the fix for the React Server: https://github.com/facebook/react/pull/35277/files https://github.com/facebook/react/pull/35277/files It looks like it only affects dynamic reloading? If I understand correctly, the client can just politely ask the server to load arbitrary code, and the server agrees. This should never be enabled in production in the first place. I'm not surprised that they are fundamentally vulnerable, and this is likely not going to be the last RCE in this part of the code.
- EdwardDiego 11mo agoUnrelated but... wow, this is... certainly some code. return "*" === metadata[2] ? moduleExports : "" === metadata[2] ? moduleExports.__esModule ? moduleExports.default : moduleExports : moduleExports[metadata[2]];
- bri3d 11mo agoIt's generated code ("compiled" Javascript); I found it easier to read than the "main" diff in React which was (intentionally, I think?) obfuscated with additional changesets.