GHSA-vfj7-8cjw-p6xm found in npm/[email protected]
I maintainer di solito rispondono entro 1 giorno
Nessuno ha ancora preso questa issue.
Valutazione
- Difficoltà
- 2/5
- Tempo stimato
- 1-3 ore
- Idoneità per principianti
- 68/100
- Tipo di issue
- Bug
- Chiarezza
- Specificata chiaramente
- Stato di attività
- Attiva
- Stack tecnologico
- javascript, node.js
Direzione di ricerca
Inizia eseguendo npm audit nel progetto devguard-documentation e controlla il percorso delle dipendenze tramite patch-package, find-yarn-workspace-root e micromatch fino a [email protected]. Applica l’aggiornamento delle dipendenze npm consigliato, quindi esegui di nuovo l’audit; il lavoro è completato quando braces è alla versione 3.0.4 o successiva e la vulnerabilità segnalata è stata risolta.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Descrizione
GHSA-vfj7-8cjw-p6xm found in npm/[email protected]
[!important]
Risk:0.87 (Low)
CVSS:7.5
Description
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
Affected component
The vulnerability is in pkg:npm/[email protected], found in artifacts pkg:devguard/l3montree-cybersecurity/devguard/devguard-documentation.
Recommended fix
Upgrade to version 3.0.4 or later.
# Update all vulnerable npm packages
npm audit fix
# Update only this package
npm install [email protected]
Additional guidance for mitigating vulnerabilities
Visit our guides on devguard.org
See more details...
Path to component
%%{init: { 'theme':'base', 'themeVariables': {
'primaryColor': '#F3F3F3',
'primaryTextColor': '#0D1117',
'primaryBorderColor': '#999999',
'lineColor': '#999999',
'secondaryColor': '#ffffff',
'tertiaryColor': '#ffffff'
} }}%%
flowchart TD
Your_application(["Your application"]) --- pkg_npm_patch_package_8_0_1(["pkg:npm/patch-package\@8.0.1"])
pkg_npm_patch_package_8_0_1(["pkg:npm/patch-package\@8.0.1"]) --- pkg_npm_find_yarn_workspace_root_2_0_0(["pkg:npm/find-yarn-workspace-root\@2.0.0"])
pkg_npm_find_yarn_workspace_root_2_0_0(["pkg:npm/find-yarn-workspace-root\@2.0.0"]) --- pkg_npm_micromatch_4_0_8(["pkg:npm/micromatch\@4.0.8"])
pkg_npm_micromatch_4_0_8(["pkg:npm/micromatch\@4.0.8"]) --- pkg_npm_braces_3_0_3(["pkg:npm/braces\@3.0.3"])
classDef default stroke-width:2px
| Risk Factor | Value | Description |
|---|---|---|
| Vulnerability Depth | 4 |
The vulnerability is in a dependency of a dependency in your project. It is 4 levels deep. |
| EPSS | 0.74 % |
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days. |
| EXPLOIT | Not available |
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database. There are no script kiddies exploiting this vulnerability. |
| CVSS-BE | 7.5 |
- Exploiting this vulnerability significantly impacts availability. |
| CVSS-B | 7.5 |
- The vulnerability can be exploited over the network without needing physical access. - It is easy for an attacker to exploit this vulnerability. - An attacker does not need any special privileges or access rights. - No user interaction is needed for the attacker to exploit this vulnerability. - The impact is confined to the system where the vulnerability exists. - There is a high impact on the availability of the system. |
More details can be found in DevGuard
Interact with this vulnerability
You can use the following slash commands to interact with this vulnerability:
👍 Reply with this to acknowledge and accept the identified risk.
/accept I accept the risk of this vulnerability, because ...
⚠️ Mark the risk as false positive: Use one of these commands if you believe the reported vulnerability is not actually a valid issue.
/component-not-present The vulnerable component is not included in the artifact.
/vulnerable-code-not-present The component is present, but the vulnerable code is not included or compiled.
/vulnerable-code-not-in-execute-path The vulnerable code exists, but is never executed at runtime.
/vulnerable-code-cannot-be-controlled-by-adversary Built-in protections prevent exploitation of this vulnerability.
/inline-mitigations-already-exist The vulnerable code cannot be controlled or influenced by an attacker.
🔁 Reopen the risk: Use this command to reopen a previously closed or accepted vulnerability.
/reopen ...
- Lingua principale
- MDX
- Stelle
- 8
- Fork
- 4
- Merge medio
- 3g 12m
- PR unite (30g)
- 6
Preparare l'ambiente
- Include un Dockerfile o un file Docker Compose
- Nessun modello di pull request
- Leggi la guida per i contributori
Come iniziare
- Leggi tutta la issue e poi la guida ai contributi del progetto.
- Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
- Fai un fork del repository e lavora su un branch.
- Apri una pull request che faccia riferimento al numero della issue.
Issue simili
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 72/100
I maintainer di solito rispondono entro 1 giorno
-
feature
Difficoltà 2/5 1-3 ore Idoneità per principianti 78/100
calagopus/panel#285 · 1 commento ·
I maintainer di solito rispondono entro 1 giorno
-
needs-triage
Difficoltà 2/5 1-3 ore Idoneità per principianti 65/100
manaflow-ai/cmux#32617 ·
I maintainer di solito rispondono entro 1 giorno
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 72/100
ossf/wg-best-practices-os-developers#1193 ·
I maintainer di solito rispondono entro 1 giorno
-
enhancement good first issue
Difficoltà 2/5 1-3 ore Idoneità per principianti 78/100
laaielichter/Gulliver#22 ·
I maintainer di solito rispondono entro 1 giorno