Platform
nodejs
Component
pouchdb
Fixed in
6.0.5
CVE-2016-10546 is a critical remote code execution (RCE) vulnerability affecting versions of PouchDB prior to 6.0.5. This flaw stems from inadequate sandboxing of the code execution engine used for map and reduce functions within temporary views and design documents. Successful exploitation allows an attacker to execute arbitrary code on the server, potentially leading to complete system compromise. Upgrade to version 6.0.5 or later to resolve this issue.
The impact of CVE-2016-10546 is severe. An attacker who can inject malicious code into the map or reduce functions of a PouchDB view can gain complete control over the server running the Node.js application. This could involve reading sensitive data, modifying application logic, installing malware, or pivoting to other systems on the network. The vulnerability's ease of exploitation, combined with PouchDB's use in various applications, makes it a significant security risk. The ability to execute arbitrary code directly on the server bypasses typical security controls and represents a high-severity threat.
CVE-2016-10546 was publicly disclosed in July 2018. While no active exploitation campaigns have been definitively linked to this specific CVE, the potential for remote code execution makes it a high-priority vulnerability. It is not listed on the CISA KEV catalog. Public proof-of-concept exploits are available, demonstrating the ease of exploitation.
Exploit Status
EPSS
0.93% (76% percentile)
The primary mitigation for CVE-2016-10546 is to upgrade PouchDB to version 6.0.5 or later. If upgrading is not immediately feasible, consider implementing strict input validation and sanitization on any data used in map and reduce functions. While not a complete solution, this can reduce the attack surface. Review and audit all PouchDB view configurations to ensure that user-supplied data is not directly incorporated into map/reduce functions without proper validation. There are no specific WAF rules or detection signatures readily available for this vulnerability, making timely patching crucial.
No official patch available. Check for workarounds or monitor for updates.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2016-10546 is a critical remote code execution vulnerability in PouchDB versions before 6.0.5, allowing attackers to execute arbitrary code due to improper sandboxing of map/reduce functions.
You are affected if you are using PouchDB versions prior to 6.0.5 in your Node.js application. Check your installed version using npm list pouchdb.
Upgrade PouchDB to version 6.0.5 or later. This resolves the improper sandboxing issue and prevents arbitrary code execution.
While no confirmed active campaigns are publicly known, the vulnerability's severity and ease of exploitation make it a potential target. Monitor your systems for suspicious activity.
Refer to the PouchDB project's release notes and security advisories on their GitHub repository for details: https://github.com/pouchdb/pouchdb/releases
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.