Description

All versions of package transpile are vulnerable to Denial of Service (DoS) due to a lack of input sanitization or whitelisting, coupled with improper exception handling in the .to() function.

Remediation

References

https://github.com/stealjs/transpile/blob/56aaeb26f69496e45a60c03dc92653d53021d4ac/main.js%23L53

https://snyk.io/vuln/SNYK-JS-TRANSPILE-1290774

Related Vulnerabilities

CVE-2021-41151 Vulnerability in npm package @backstage/plugin-scaffolder-backend

CVE-2021-44228 Vulnerability in maven package org.apache.logging.log4j:log4j-core

CVE-2021-3820 Vulnerability in npm package i

CVE-2020-28281 Vulnerability in npm package set-object-value

CVE-2020-7770 Vulnerability in npm package json8

Severity

High

Classification

CWE-755 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Broken Link Exploit Third Party Advisory