From One Row of Data to a Root Shell: Five CVEs in Perspective 5.0.0
Five vulnerabilities in the Perspective analytics engine, including an unsandboxed eval() in the query path and a stored XSS in the plugin that loads by default. Chained, they take an attacker from writing one row of data to command execution on the server host.
Perspective is an interactive analytics and data visualization component. The query engine is written in C++ and compiled three ways: to WebAssembly for the browser, to a native Python extension, and to a Rust crate. It ships as perspective-python on PyPI, @perspective-dev/client and @perspective-dev/viewer on npm, and perspective on crates.io. If you have used an internal dashboard at a bank or a trading desk in the last few years, you have probably used it.
The rest is coming soon