registry / @shotstack/shotstack-studio / 2.19.4

@shotstack/shotstack-studio@2.19.4

A video editing library for creating and editing videos with Shotstack

AI Security Review

scanned 23d ago · by lpm-firewall-ai

The browser runtime downloads a third-party JavaScript response and evaluates it. This gives that remote endpoint code execution in every application that reaches the WOFF2 font-loading path.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

An application using the library loads a WOFF2 font asset.

Impact

A changed or compromised remote response can run arbitrary JavaScript in the consuming application's browser context.

Mechanism

Fetch remote JavaScript and execute it with Function.

Attack narrative

When the font loader handles a WOFF2 asset, it requests a JavaScript file from unpkg.com, appends a return statement, and passes the response to the Function constructor. The returned module is then initialized and used as the decompressor. Because the downloaded text is neither packaged nor integrity-pinned before execution, control of that remote response yields arbitrary script execution in the consumer's browser context.

AI rationale

The package contains a reachable remote-code loader that executes unverified network content. This is a concrete remote code execution surface despite the absence of install-time hooks.

Evidence

dist/shotstack-studio.es.js

Network endpoints1

unpkg.com/wawoff2@2.0.1/build/decompress_binding.js

Decision evidence

public snapshot

@shotstack/shotstack-studio@2.19.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code