description: Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of that project. Those scripts would have the ability to execute arbitrary code on the system as the application.
problem types: CWE-99: Improper Control of Resource Identifiers ('Resource Injection')
affected:
{
defaultStatus: unaffected
product: Meta Spark Studio
vendor: Meta Platforms, Inc
versions:
lessThan: 176, status: affected, version: 0, versionType: semver
}