An arbitrary code injection vector was found in PouchDB 6.0.4 and lesser via the map/reduce functions used in PouchDB temporary views and design documents.
CVSS 3.0CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.02565·Published 2018-05-31·Fixed in 6.0.5CWE-94