GHSA-53MJ-MC38-Q894

Remote Memory Exposure in openwhisk

Versions of openwhisk before 3.3.1 are vulnerable to remote memory exposure.

When a number is passed to api_key, affected versions of openwhisk allocate an uninitialized buffer and send that over network in Authorization header (base64-encoded).

Proof of concept:

var openwhisk = require('openwhisk');
var options = {
  apihost: '127.0.0.1:1433', 
  api_key: USERSUPPLIEDINPUT // number
};
var ow = openwhisk(options);
ow.actions.invoke({actionName: 'sample'}).then(result => console.log(result))

Kodem intelligence

Already deployed Kodem?

Update to version 3.3.1 or later.

1. What is GHSA-53MJ-MC38-Q894? GHSA-53MJ-MC38-Q894 is a medium-severity security vulnerability in openwhisk (npm), affecting versions < 3.3.1. It is fixed in 3.3.1.
2. Which versions of openwhisk are affected by GHSA-53MJ-MC38-Q894? openwhisk (npm) versions < 3.3.1 is affected.
3. Is there a fix for GHSA-53MJ-MC38-Q894? Yes. GHSA-53MJ-MC38-Q894 is fixed in 3.3.1. Upgrade to this version or later.
4. Is GHSA-53MJ-MC38-Q894 exploitable, and should I be worried? Whether GHSA-53MJ-MC38-Q894 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether GHSA-53MJ-MC38-Q894 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix GHSA-53MJ-MC38-Q894? Upgrade openwhisk to 3.3.1 or later.