braces through 3.0.3 Stack Overflow via Deeply Nested Patterns
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.4%
probabilidade de exploração
0.4%top 65% das CVEs
exploração observada
nãonenhuma fonte reporta
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
micromatch · bracesReferências
https://github.com/micromatch/braceshttps://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40https://github.com/micromatch/braces/issues/70https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns