Vulnerabilities

 1 via 1 paths

Dependencies

 119

Source

 GitHub

Commit

 7df86085

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
Status
  • 1
  • 0
  • 0

high severity
new

XML Entity Expansion (Billion Laughs)

  • Vulnerable module: svgo
  • Introduced through: @rpl/badge-up@3.0.0

Detailed paths

  • Introduced through: coveradge@brettz9/coveradge#7df860858d33b594ad3952a212094ae4a6b60ef3 › @rpl/badge-up@3.0.0 › svgo@2.6.0

Overview

Affected versions of this package are vulnerable to XML Entity Expansion (Billion Laughs) when parsing of custom XML entities in DOCTYPE. An attacker can cause the application to consume excessive memory by submitting malicious SVG files containing recursive entity references.

Workaround

For version 4.0.0, upgrading the sax dependency to 1.5.0 recursively (yarn -R) mitigates this vulnerability.

Remediation

Upgrade svgo to version 2.8.1, 3.3.3, 4.0.1 or higher.

References

XML Entity Expansion (Billion Laughs) vulnerability report