Description

The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the underscore or unescapeHTML methods.

Remediation

References

https://nodesecurity.io/advisories/536

https://github.com/jprichardson/string.js/issues/212

Related Vulnerabilities

CVE-2021-23337 Vulnerability in maven package org.webjars.bower:lodash

CVE-2022-35961 Vulnerability in maven package org.webjars.npm:openzeppelin__contracts-upgradeable

CVE-2023-35158 Vulnerability in maven package org.xwiki.platform:xwiki-platform-flamingo-skin-resources

CVE-2016-5018 Vulnerability in maven package org.apache.tomcat:tomcat-jasper

CVE-2014-7810 Vulnerability in maven package org.apache.tomcat:tomcat-jasper

Severity

High

Classification

CWE-400 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Patch Third Party Advisory Exploit