CVE-2018-6333

CVE-2018-6333 describes a critical vulnerability in Facebook Nuclide versions prior to v0.290.0, where the hhvm-attach deep link handler failed to sanitize the hostname parameter. This allowed for malicious URLs to inject HTML and other content within the editor's context, potentially leading to remote code execution. With a CVSS score of 9.8 (CRITICAL) and an attack vector of Network with low complexity, the potential impact includes complete compromise of confidentiality, integrity, and availability. While there are no known public exploits or Metasploit modules, the vulnerability has garnered some community discussion and media coverage, indicating awareness despite no active exploitation reported.