CyberRota Analysis
AI-GeneratedThe vulnerability affects the Nango framework prior to version 0.71.6, specifically in the runner tRPC server, which lacks proper authentication controls. This flaw allows unauthenticated attackers with network access to execute arbitrary JavaScript code by invoking the exposed start procedure, leading to potential remote code execution. Organizations utilizing Nango should prioritize patching this vulnerability to mitigate the risk of unauthorized access and code execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process.