PT-2022-10232

CVE-2021-33420

Published

2022-12-15

Updated

2025-04-21

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions inikulin replicator versions prior to 1.0.4

Description A deserialization issue in the inikulin replicator allows remote attackers to run arbitrary code via the fromSerializable function in the TypedArray object.

Recommendations For versions prior to 1.0.4, update to version 1.0.4 or later to resolve the issue. As a temporary workaround, consider disabling the fromSerializable function in the TypedArray object until a patch is available.

Exploitability

Exploit

Fix

Impacts

Researchers

Yaniv Nizry

Vendors

Affected products

Weakness enumeration

CWE-502: Deserialization of Untrusted Data

Related identifiers

CVE-2021-33420