GHSA-53mj-mc38-q894
Remote Memory Exposure in openwhisk
Versions of openwhisk before 3.3.1 are vulnerable to remote memory exposure.
When a number is passed to api_key, affected versions of openwhisk allocate an uninitialized buffer and send that over network in Authorization header (base64-encoded).
Proof of concept:
var openwhisk = require('openwhisk');
var options = {
apihost: '127.0.0.1:1433',
api_key: USERSUPPLIEDINPUT // number
};
var ow = openwhisk(options);
ow.actions.invoke({actionName: 'sample'}).then(result => console.log(result))
Recommendation
Update to version 3.3.1 or later.
What each source reports
GitHub AdvisoriesNo score
Remote Memory Exposure in openwhisk
Versions of openwhisk before 3.3.1 are vulnerable to remote memory exposure.
When a number is passed to api_key, affected versions of openwhisk allocate an uninitialized buffer and send that over network in Authorization header (base64-encoded).
Proof of concept:
var openwhisk = require('openwhisk');
var options = {
apihost: '127.0.0.1:1433',
api_key: USERSUPPLIEDINPUT // number
};
var ow = openwhisk(options);
ow.actions.invoke({actionName: 'sample'}).then(result => console.log(result))
Recommendation
Update to version 3.3.1 or later.
- Record
GHSA-53mj-mc38-q894- Updated
- 2026-11-02
OSVNo score
Remote Memory Exposure in openwhisk
Versions of openwhisk before 3.3.1 are vulnerable to remote memory exposure.
When a number is passed to api_key, affected versions of openwhisk allocate an uninitialized buffer and send that over network in Authorization header (base64-encoded).
Proof of concept:
var openwhisk = require('openwhisk');
var options = {
apihost: '127.0.0.1:1433',
api_key: USERSUPPLIEDINPUT // number
};
var ow = openwhisk(options);
ow.actions.invoke({actionName: 'sample'}).then(result => console.log(result))
Recommendation
Update to version 3.3.1 or later.
- Record
GHSA-53mj-mc38-q894- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openwhisknpm | before 3.3.1 | 3.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-53mj-mc38-q894 is a vulnerability with no CVSS score yet in openwhisk, published September 1, 2020. No source lists public exploit code. Fixed in openwhisk 3.3.1.