Vulnerabilities

 3 via 6 paths

Dependencies

 99

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 2
  • 1
Status
  • 3
  • 0
  • 0

high severity

Infinite loop

  • Vulnerable module: image-size
  • Introduced through: @deck.gl/mesh-layers@8.8.25 and @deck.gl/geo-layers@8.8.25

Detailed paths

  • Introduced through: mtw-boilerplate-decks@MyThemeWay/mtw-boilerplate-decks › @deck.gl/mesh-layers@8.8.25 › @loaders.gl/gltf@3.4.15 › @loaders.gl/textures@3.4.15 › texture-compressor@1.0.2 › image-size@0.7.5
  • Introduced through: mtw-boilerplate-decks@MyThemeWay/mtw-boilerplate-decks › @deck.gl/geo-layers@8.8.25 › @loaders.gl/3d-tiles@3.4.15 › @loaders.gl/gltf@3.4.15 › @loaders.gl/textures@3.4.15 › texture-compressor@1.0.2 › image-size@0.7.5

Overview

Affected versions of this package are vulnerable to Infinite loop in the extractPartialStreams() and corresponding extraction functions for HEIF, JP2, and JXL. An attacker supplying an image whose requested box declares a size of zero can hang the parser indefinitely.

Note: This is a bypass of the fix for the vulnerability described in CVE-2025-71319.

Remediation

Upgrade image-size to version 2.0.3 or higher.

References

Infinite loop vulnerability report

high severity

Infinite loop

  • Vulnerable module: image-size
  • Introduced through: @deck.gl/mesh-layers@8.8.25 and @deck.gl/geo-layers@8.8.25

Detailed paths

  • Introduced through: mtw-boilerplate-decks@MyThemeWay/mtw-boilerplate-decks › @deck.gl/mesh-layers@8.8.25 › @loaders.gl/gltf@3.4.15 › @loaders.gl/textures@3.4.15 › texture-compressor@1.0.2 › image-size@0.7.5
  • Introduced through: mtw-boilerplate-decks@MyThemeWay/mtw-boilerplate-decks › @deck.gl/geo-layers@8.8.25 › @loaders.gl/3d-tiles@3.4.15 › @loaders.gl/gltf@3.4.15 › @loaders.gl/textures@3.4.15 › texture-compressor@1.0.2 › image-size@0.7.5

Overview

Affected versions of this package are vulnerable to Infinite loop in icns.js. An ICNS file with an icon entry whose declared length is zero can hang the parser indefinitely.

Remediation

Upgrade image-size to version 2.0.3 or higher.

References

Infinite loop vulnerability report

medium severity
new

Improper Validation of Specified Quantity in Input

  • Vulnerable module: sprintf-js
  • Introduced through: @deck.gl/mesh-layers@8.8.25 and @deck.gl/geo-layers@8.8.25

Detailed paths

  • Introduced through: mtw-boilerplate-decks@MyThemeWay/mtw-boilerplate-decks › @deck.gl/mesh-layers@8.8.25 › @loaders.gl/gltf@3.4.15 › @loaders.gl/textures@3.4.15 › texture-compressor@1.0.2 › argparse@1.0.10 › sprintf-js@1.0.3
  • Introduced through: mtw-boilerplate-decks@MyThemeWay/mtw-boilerplate-decks › @deck.gl/geo-layers@8.8.25 › @loaders.gl/3d-tiles@3.4.15 › @loaders.gl/gltf@3.4.15 › @loaders.gl/textures@3.4.15 › texture-compressor@1.0.2 › argparse@1.0.10 › sprintf-js@1.0.3

Overview

Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via unbounded precision specifiers passed without validation to the toFixed, toExponential, and toPrecision methods. An attacker who controls a format string can inject precision values exceeding ECMAScript limits, causing uncaught RangeError exceptions that abort the calling operation.

Remediation

There is no fixed version for sprintf-js.

References

Improper Validation of Specified Quantity in Input vulnerability report