Vulnerabilities

 2 via 2 paths

Dependencies

 6

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
  • 1
Status
  • 2
  • 0
  • 0

high severity
new

Infinite loop

  • Vulnerable module: uri-js
  • Introduced through: ajv@6.15.0

Detailed paths

  • Introduced through: csmath@EricSekyere/npm-publish › ajv@6.15.0 › uri-js@4.4.1

Overview

uri-js is a RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript.

Affected versions of this package are vulnerable to Infinite loop via the removeDotSegments function, which loops infinitely when a path segment begins with Unicode line separators (U+2028) or paragraph separators (U+2029). An attacker can trigger this by passing such a path to removeDotSegments directly, or through the normalize or resolve functions with IRI handling enabled, blocking the Node.js event loop indefinitely until heap exhaustion.

Remediation

There is no fixed version for uri-js.

References

Infinite loop vulnerability report

medium severity
new

Improper Encoding or Escaping of Output

  • Vulnerable module: uri-js
  • Introduced through: ajv@6.15.0

Detailed paths

  • Introduced through: csmath@EricSekyere/npm-publish › ajv@6.15.0 › uri-js@4.4.1

Overview

uri-js is a RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript.

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via pctDecChars(), which decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. An attacker can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequences that downstream consumers process without filtering.

Remediation

There is no fixed version for uri-js.

References

Improper Encoding or Escaping of Output vulnerability report