Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS03NzNoLXc0NXctZjJmOc3X5A

Denial of service vulnerability exists in libxmljs

libxmljs provides libxml bindings for v8 javascript engine. This affects all versions of package libxmljs. When invoking the libxmljs.parseXml function with a non-buffer argument the V8 code will attempt invoking the .toString method of the argument. If the argument's toString value is not a Function object V8 will crash.

Permalink: https://github.com/advisories/GHSA-773h-w45w-f2f9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03NzNoLXc0NXctZjJmOc3X5A
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: over 1 year ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-773h-w45w-f2f9, CVE-2022-21144
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-21144
• https://github.com/libxmljs/libxmljs/pull/594
• https://github.com/libxmljs/libxmljs/commit/2501807bde9b38cfaed06d1e140487516d91379d
• https://snyk.io/vuln/SNYK-JS-LIBXMLJS-2348756
• https://github.com/advisories/GHSA-773h-w45w-f2f9

Repository: https://github.com/libxmljs/libxmljs
Blast Radius: 24.7

Affected Packages