QwikSec

Security Database

CVE

CWE

Training

CVE-2018-6333

Published: Dec 31, 2018

Modified: May 6, 2025

PUBLISHED

Description

The hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering. As a result, a malicious URL could be used to render HTML and other content inside of the editor's context, which could potentially be chained to lead to code execution. This issue affected Nuclide prior to v0.290.0.

Vendor	Product	Versions
Facebook	Nuclide	affected `v0.290.0` affected `unspecified - <= v0.290.0`

Weaknesses (CWE)

References

https://github.com/facebook/nuclide/commit/65f6bbd683404be1bb569b8d1be84b5d4c74a324

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.