{"id":"CVE-2021-32684","aliases":["EUVD-2021-1262","GHSA-52qp-gwwh-qrg4"],"status":"published","title":"Missing Handler in @scandipwa/magento-scripts","description":"magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Magento 2. In versions 1.5.1 and 1.5.2, after changing the function from synchronous to asynchronous there wasn't implemented handler in the start, stop, exec, and logs commands, effectively making them unusable. Version 1.5.3 contains patches for the problems.","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00702,"percentile":0.53586,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-670"],"published":"2021-06-14T23:05:09Z","modified":"2026-10-20T10:54:42Z","fixes":[{"ecosystem":"npm","package":"@scandipwa/magento-scripts","fixed_in":["1.5.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@scandipwa/magento-scripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.1"},{"fixed":"1.5.3"}]}]},{"source":"osv","ecosystem":"npm","package":"@scandipwa/magento-scripts","ranges":[{"type":"SEMVER","events":[{"introduced":"1.5.1"},{"fixed":"1.5.3"}]}]}],"products":[{"vendor":"scandipwa","product":"create-magento-app"},{"vendor":"scandipwa","product":"magento-scripts"}],"references":[{"url":"https://github.com/scandipwa/create-magento-app/security/advisories/GHSA-52qp-gwwh-qrg4","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/scandipwa/create-magento-app/commit/89115db7031e181eb8fb4ec2822bc6cab88e7071","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32684","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-52qp-gwwh-qrg4"}],"sources":{"cve":[{"id":"CVE-2021-32684","title":"Missing Handler in @scandipwa/magento-scripts","description":"magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Magento 2. In versions 1.5.1 and 1.5.2, after changing the function from synchronous to asynchronous there wasn't implemented handler in the start, stop, exec, and logs commands, effectively making them unusable. Version 1.5.3 contains patches for the problems.","status":"published","published":"2021-06-14T23:05:09Z","modified":"2024-08-03T23:25:31.123Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-670"],"updated_at":"2026-11-02T14:33:07.349244Z"}],"euvd":[{"id":"EUVD-2021-1262","description":"magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Magento 2. In versions 1.5.1 and 1.5.2, after changing the function from synchronous to asynchronous there wasn't implemented handler in the start, stop, exec, and logs commands, effectively making them unusable. Version 1.5.3 contains patches for the problems.","status":"published","published":"2021-06-14T23:05:09Z","modified":"2024-08-03T23:25:31Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T03:24:36.41075Z"}],"ghsa":[{"id":"GHSA-52qp-gwwh-qrg4","title":"Missing Handler in @scandipwa/magento-scripts","description":"### Impact\nAfter changing the function from synchronous to asynchronous there wasn't implemented handler in the [start](https://docs.create-magento-app.com/getting-started/available-commands/start), [stop](https://docs.create-magento-app.com/getting-started/available-commands/stop), [exec](https://docs.create-magento-app.com/getting-started/available-commands/exec) and [logs](https://docs.create-magento-app.com/getting-started/available-commands/logs) commands, effectively making them unusable.\n\n### Patches\n[Version 1.5.3](https://github.com/scandipwa/create-magento-app/releases/tag/%40scandipwa%2Fmagento-scripts%401.5.3) contains patches for the problems described above.\n\n### Workarounds\nUpgrade to patched or latest (recommended) version `npm i @scandipwa/magento-scripts@1.5.3` or `npm i @scandipwa/magento-scripts@latest`.\n\n### References\nNew releases always available here: https://github.com/scandipwa/create-magento-app/releases\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [create-magento-app](https://github.com/scandipwa/create-magento-app/issues)\n","status":"published","published":"2021-06-21T17:10:02Z","modified":"2023-02-01T05:06:09Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-670"],"updated_at":"2026-11-02T14:36:37.441118Z"}],"nvd":[{"id":"CVE-2021-32684","description":"magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Magento 2. In versions 1.5.1 and 1.5.2, after changing the function from synchronous to asynchronous there wasn't implemented handler in the start, stop, exec, and logs commands, effectively making them unusable. Version 1.5.3 contains patches for the problems.","status":"published","published":"2021-06-14T23:15:07.547Z","modified":"2026-06-17T03:53:25.167Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-670"],"updated_at":"2026-11-02T14:06:54.892562Z"}],"osv":[{"id":"CVE-2021-32684","description":"magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Magento 2. In versions 1.5.1 and 1.5.2, after changing the function from synchronous to asynchronous there wasn't implemented handler in the start, stop, exec, and logs commands, effectively making them unusable. Version 1.5.3 contains patches for the problems.","status":"published","published":"2021-06-14T23:15:07.547Z","modified":"2026-10-20T10:54:42.767249578Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:19.793849Z"},{"id":"GHSA-52qp-gwwh-qrg4","title":"Missing Handler in @scandipwa/magento-scripts","description":"### Impact\nAfter changing the function from synchronous to asynchronous there wasn't implemented handler in the [start](https://docs.create-magento-app.com/getting-started/available-commands/start), [stop](https://docs.create-magento-app.com/getting-started/available-commands/stop), [exec](https://docs.create-magento-app.com/getting-started/available-commands/exec) and [logs](https://docs.create-magento-app.com/getting-started/available-commands/logs) commands, effectively making them unusable.\n\n### Patches\n[Version 1.5.3](https://github.com/scandipwa/create-magento-app/releases/tag/%40scandipwa%2Fmagento-scripts%401.5.3) contains patches for the problems described above.\n\n### Workarounds\nUpgrade to patched or latest (recommended) version `npm i @scandipwa/magento-scripts@1.5.3` or `npm i @scandipwa/magento-scripts@latest`.\n\n### References\nNew releases always available here: https://github.com/scandipwa/create-magento-app/releases\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [create-magento-app](https://github.com/scandipwa/create-magento-app/issues)\n","status":"published","published":"2021-06-21T17:10:02Z","modified":"2026-07-08T06:28:52.345940028Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-670"],"updated_at":"2026-11-02T15:46:37.864461Z"}]}}